Bobcares

WeSupport

Call Us! 1-800-383-5193
Call Us! 1-800-383-5193
Call Us! 1-800-383-5193

Need Help?

Emergency Response Time custom

Our experts have had an average response time of 11.06 minutes in March 2021 to fix urgent issues.

We will keep your servers stable, secure and fast at all times for one fixed price.

Restrict su access to Privileged Accounts in Linux – How to do it

by | May 15, 2021

Need to Restrict su access to Privileged Accounts in Linux? We can help you.

To limit the access, the su utility requests appropriate user credentials via PAM and switches to that user ID.

As part of our Server Management Services, we assist our customers with several Linux queries.

Today, let us see how to configure PAM to restrict su to some users only in a Linux system.

 

Restrict su access to Privileged Accounts in Linux

We will create a group and restrict the use of su to the users in the group.

We use PAM to set the policy that the su will use. It configures to allow different groups of users access to specific target UIDs through su.

We require the below PAM modules for this operation:

pam_succeed_if
pam_wheel.so
pam_listfile.so

Step 1: Create groups and add users

First and foremost, we need to create Linux groups.

For example, sysadmins and dbadmins:

$ sudo groupadd sysadmins
$ sudo groupadd dbadmins

Then we create three users, admin1, dbuser1, and testuser1.

# Create admin1 user
$ sudo useradd admin1
$ sudo passwd admin1

# Create dbuser1
$ sudo useradd dbuser1
$ sudo passwd dbuser1

# Create testuser1
$ sudo useradd testuser1
$ sudo passwd testuser1

We assign admin1 user to sysadmins group.

$ sudo usermod -G sysadmins admin1

Then the dbuser1 user to dbadmins group.

$ sudo usermod -G dbadmins dbuser1

Ensure the users correctly assign to the relevant groups by checking the output of getent:

$ getent group sysadmins
sysadmins:x:1001:admin1

$ getent group dbadmins
dbadmins:x:1002:dbuser1

Step 2: Configure su PAM Policy

We create a new file /etc/security/su-sysadmins-access file. Here, we add the target UIDs that users in the sysadmins group are allowed to access:

$ sudo vim /etc/security/su-sysadmins-access
root

Similarly, we create another file /etc/security/su-dbadmins-access. Then we add the target UIDs that users in the dbadmins group are allowed to access:

$ sudo vim /etc/security/su-dbadmins-access
postgres
oracle

We can limit write access of the file to only the root user.

$ sudo chown root:root /etc/security/su-sysadmins-access
$ sudo chown root:root /etc/security/su-dbadmins-access

$ sudo chmod 0644 /etc/security/su-sysadmins-access
$ sudo chmod 0644 /etc/security/su-dbadmins-access

Confirm permissions:

$ ls -lh /etc/security/su-sysadmins-access
-rw-r–r–. 1 root root 5 Jan 30 10:19 /etc/security/su-sysadmins-access

$ ls -lh /etc/security/su-dbadmins-access
-rw-r–r–. 1 root root 16 Jan 30 10:20 /etc/security/su-dbadmins-access

In addition, we configure PAM by editing the file /etc/pam.d/su:

$ sudo vim /etc/pam.d/su

We add the following lines:

auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup sysadmins
auth required pam_wheel.so use_uid group=sysadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-sysadmins-access
auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup dbadmins
auth required pam_wheel.so use_uid group=dbadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-dbadmins-access

The su file will look like this:

#%PAM-1.0
auth sufficient pam_rootok.so
auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup sysadmins
auth required pam_wheel.so use_uid group=sysadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-sysadmins-access
auth [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup dbadmins
auth required pam_wheel.so use_uid group=dbadmins
auth required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-dbadmins-access
auth include system-auth
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session optional pam_xauth.so

Step 3: Test su PAM policies

Firstly, we log in as admin1 user and use su to try and change UID to a permitted root user:

$ ssh admin1@localhost
[admin1@centos ~]$ su – root #enter root user password
Password:
Last login: Sat May 10 10:17:26 UTC 2021 from 172.20.11.12 on pts/0
[root@centos ~]# exit
logout

Then we log in as dbuser1 user and use su to try and change UID to a permitted postgres user:

$ ssh dbuser1@localhost
$ su – postgres # the user should exist before

# Or
$ su – oracle

Finally, we log in as testuser1 user and try any su that may fail

$ ssh testuser1@localhost
$ su – root
$ su – postgres

[Couldn’t limit su access? We are here for you]

 

Conclusion

In short, today, we saw an effective method our Support Techs employ to restrict the su access.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

GET STARTED

var google_conversion_label = "owonCMyG5nEQ0aD71QM";

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center

Necessary

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]
PHPSESSID
WHMCSpKDlPzh2chML

Statistics

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid
smartlookCookie

Marketing

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie
1P_JAR, NID, DV
NID
hblid

Security

These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.

SID, APISID, HSID, NID, PREF
SID, APISID, HSID, NID, PREF