Home > Article > System Tutorial > Teach you how to prohibit ordinary users from using the su command in Linux
Teach you how to prohibit ordinary users from using the su command in Linux
- WBOYforward
- 2024-02-09 21:21:151071browse
su command is a special command that allows a user to run commands as another user and group. It also allows you to switch to the root account or another designated user account.
To switch to another user account, users can run the su command from their current login session, as shown below Users can switch users via su:
[bob@localhost ~]$ su - user01 Password:
By default, all users can use the su command. We can disable the su command in /etc/sudoers.
To switch to the root account, the user must have a root password. In this example, the user is switching to the root account.
[user01@localhost ~]$ su - Password:
Disable su access for ordinary users
Disable su access rights for ordinary users. First, back up the original files of the following /etc/sudoers as follows:
[bob@localhost ~]$ sudo cp -p /etc/sudoers /etc/sudoers.back [sudo] password for bob:
Use the visudo command to open the sudoers configuration file
[bob@localhost ~]$ sudo visudo
Add the following lines below the ## Command Aliases section:
Cmnd_Alias DISABLE_SU = /usr/bin/su
Then add the following line at the end of the file, replacing username bob with the user you need to disable su access:
bob ALL=(ALL) NOPASSWD: ALL, !DISABLE_SU
Save and exit
Use bob user to verify. The system should return the following error message “Sorry, user bob is not allowed to execute ‘/bin/su – user01’ as root on localhost.localdomain.”
[bob@localhost ~]$ sudo su - user01 Sorry, user bob is not allowed to execute '/bin/su - user01' as root on localhost.localdomain.
Disable su access for user group
You can also disable the su access rights of the user group. For example, to disable su access for all users in the group wheel, you can execute the following command:
[bob@localhost ~]$ sudo visudo %wheel ALL=(ALL) ALL, !DISABLE_SU
Save and exit~
The above is the detailed content of Teach you how to prohibit ordinary users from using the su command in Linux. For more information, please follow other related articles on the PHP Chinese website!