5 kx
5 kx Protect su with pam_wheel:
5 kx =========================
5 kx
5 kx You need to add a new group "wheel" to your system.
5 kx
5 kx # addgroup --system wheel
5 kx
5 kx Add users that should be able to su to this group.
5 kx
5 kx # usermod -a -G wheel user1
5 kx
5 kx Then add the following line to /etc/pam.d/su:
5 kx
5 kx auth requisite pam_wheel.so group=wheel
5 kx
5 kx Other users will not be able to become root, they
5 kx willget a denied message if they try to become root.
5 kx
5 kx test1@deby:~$ su -
5 kx su: Permission denied
5 kx
5 kx If you want wheel members to be able to su without
5 kx a password add the following.
5 kx
5 kx auth sufficient pam_wheel.so group=wheel trust use_uid
5 kx .