Limiting Root Access - Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual

43.1.4.3. Limiting Root Access

Rather than completely denying access to the root user, the administrator may want to allow access
only via setuid programs, such as su or sudo.
43.1.4.3.1. The su Command
When a user executes the su command, they are prompted for the root password and, after
authentication, is given a root shell prompt.
Once logged in via the su command, the user is the root user and has absolute administrative
3
access to the system . In addition, once a user has become root, it is possible for them to use the su
command to change to any other user on the system without being prompted for a password.
Because this program is so powerful, administrators within an organization may wish to limit who has
access to the command.
One of the simplest ways to do this is to add users to the special administrative group called wheel. To
do this, type the following command as root:
usermod -G wheel <username>
In the previous command, replace <username> with the username you want to add to the wheel
group.
You can also use the User Manager to modify group memberships, as follows. Note: you need
Administrator privileges to perform this procedure.
Click the System menu on the Panel, point to Administration and then click Users and Groups
1.
to display the User Manager. Alternatively, type the command system-config-users at a shell
prompt.
Click the Users tab, and select the required user in the list of users.
2.
Click Properties on the toolbar to display the User Properties dialog box (or choose Properties
3.
on the File menu).
Click the Groups tab, select the check box for the wheel group, and then click OK. Refer to
4.
Figure 43.2, "Adding users to the "wheel"
5. Open the PAM configuration file for su (/etc/pam.d/su) in a text editor and remove the
comment # from the following line:
auth required /lib/security/$ISA/pam_wheel.so use_uid
This change means that only members of the administrative group wheel can use this program.
This access is still subject to the restrictions imposed by SELinux, if it is enabled.
group.".
Administrative Controls
615