How to limit the use of su command on Linux to only Privileged Accounts such as Admin user group?

To limit the access, the su utility requests appropriate user credentials via PAM and switches to that user ID.

We will create a group and restrict use of su to the users in the group. PAM  is used to set the policy that the su will use. It can be configured to allow different groups of users access to specific target UIDs through su. 

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to perform related Linux queries.

In this context, we shall look into how to configure pam to restrict su to some users only in a Linux system.

How to Restrict su access to Privileged Accounts in Linux ?

We will create a group and restrict the use of su to the users in the group.

We use PAM to set the policy that the su will use. It configures to allow different groups of users access to specific target UIDs through su.

We require the below PAM modules for this operation:

• pam_succeed_if
• pam_wheel.so
• pam_listfile.so

1. Create groups and add users

First and foremost, we need to create Linux groups.

For example, sysadmins and dbadmins:

$ sudo groupadd sysadmins
$ sudo groupadd dbadmins

Then we create three users, admin1, dbuser1, and testuser1.

# Create admin1 user
$ sudo useradd admin1
$ sudo passwd admin1
# Create dbuser1
$ sudo useradd dbuser1
$ sudo passwd dbuser1
# Create testuser1
$ sudo useradd testuser1
$ sudo passwd testuser1

We assign admin1 user to sysadmins group.

$ sudo usermod -G sysadmins admin1

Then the dbuser1 user to dbadmins group.

$ sudo usermod -G dbadmins dbuser1

Ensure the users correctly assign to the relevant groups by checking the output of getent:

$ getent group sysadmins
sysadmins:x:1001:admin1
$ getent group dbadmins
dbadmins:x:1002:dbuser1

2. Configure su PAM Policy

We create a new file /etc/security/su-sysadmins-access file. Here, we add the target UIDs that users in the sysadmins group are allowed to access:

$ sudo vim /etc/security/su-sysadmins-access
root

Similarly, we create another file /etc/security/su-dbadmins-access. Then we add the target UIDs that users in the dbadmins group are allowed to access:

$ sudo vim /etc/security/su-dbadmins-access
postgres
oracle

We can limit write access of the file to only the root user.

$ sudo chown root:root /etc/security/su-sysadmins-access
$ sudo chown root:root /etc/security/su-dbadmins-access
$ sudo chmod 0644 /etc/security/su-sysadmins-access
$ sudo chmod 0644 /etc/security/su-dbadmins-access

Confirm permissions:

$ ls -lh /etc/security/su-sysadmins-access
-rw-r–r–. 1 root root 5 Jan 30 10:19 /etc/security/su-sysadmins-access
$ ls -lh /etc/security/su-dbadmins-access
-rw-r–r–. 1 root root 16 Jan 30 10:20 /etc/security/su-dbadmins-access

In addition, we configure PAM by editing the file /etc/pam.d/su:

$ sudo vim /etc/pam.d/su

We add the following lines:

auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup sysadmins
auth required pam_wheel.so use_uid group=sysadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-sysadmins-access
auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup dbadmins
auth required pam_wheel.so use_uid group=dbadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-dbadmins-access

The su file will look like this:

#%PAM-1.0
auth sufficient pam_rootok.so
auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup sysadmins
auth required pam_wheel.so use_uid group=sysadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-sysadmins-access
auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup dbadmins
auth required pam_wheel.so use_uid group=dbadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-dbadmins-access
auth include system-auth
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session optional pam_xauth.so

3. Test su PAM policies

Firstly, we log in as admin1 user and use su to try and change UID to a permitted root user:

$ ssh admin1@localhost
[admin1@centos ~]$ su – root #enter root user password
Password:
Last login: Sat May 10 10:17:26 UTC 2021 from 172.20.11.12 on pts/0
[root@centos ~]# exit
logout

Then we log in as dbuser1 user and use su to try and change UID to a permitted postgres user:

$ ssh dbuser1@localhost
$ su – postgres # the user should exist before
# Or
$ su – oracle

Finally, we log in as testuser1 user and try any su that may fail

$ ssh testuser1@localhost
$ su – root
$ su – postgres

[Couldn't limit su access in Linux? We are here for you. ]