Restrict su access to Privileged Accounts in Linux

How can I limit the use of su command on Linux to only Privileged Accounts such as Admin user group?. The su utility requests appropriate user credentials via PAM and switches to that user ID (the default user is the superuser). In this article we will look at how to configure pam to restrict su to some users only in a Linux system.

We will create a group and restrict use of su to the users in the group. PAM is used to set the policy that the su will use. It can be configured to allow different groups of users access to specific target UIDs through su. The PAM modules required for this operation are:

• pam_succeed_if
• pam_wheel.so
• pam_listfile.so

What we will accomplish by the end of this guide:

• Create a Linux group call sysadmins
• Configure PAM to permit users from a group permission to use su
• Switching as any other user with su will fail

Step 1: Create groups and add users

Let’s start by creating two Linux groups, sysadmins and dbadmins

sudo groupadd sysadmins
sudo groupadd dbadmins

Create three users, one called admin1, another called dbuser1 and lastly testuser1

# Create admin1 user
sudo useradd admin1
sudo passwd admin1

# Create dbuser1
sudo useradd dbuser1
sudo passwd dbuser1

# Create testuser1
sudo useradd testuser1
sudo passwd testuser1

Assign admin1 user to sysadmins group.

sudo usermod -G sysadmins admin1

Assign dbuser1 user to dbadmins group.

sudo usermod -G dbadmins dbuser1

Confirm the users is correctly assigned to the relevant groups by checking the output of getent:

$ getent group sysadmins
sysadmins:x:1001:admin1

$ getent group dbadmins
dbadmins:x:1002:dbuser1

Step 2: Configure su PAM Policy

Create a new file /etc/security/su-sysadmins-access file and add the target UIDs that users in the sysadmins group are allowed to access using su command:

$ sudo vim /etc/security/su-sysadmins-access
root

Create another file /etc/security/su-dbadmins-access and add the target UIDs that users in the dbadmins group are allowed to access using su command:

$ sudo vim /etc/security/su-dbadmins-access
postgres
oracle

Limit write access of the file created to only root user.

sudo chown root:root /etc/security/su-sysadmins-access
sudo chown root:root /etc/security/su-dbadmins-access

sudo chmod 0644 /etc/security/su-sysadmins-access
sudo chmod 0644 /etc/security/su-dbadmins-access

Confirm permissions:

$ ls -lh /etc/security/su-sysadmins-access
-rw-r--r--. 1 root root 5 Jan 30 10:19 /etc/security/su-sysadmins-access

$ ls -lh /etc/security/su-dbadmins-access
-rw-r--r--. 1 root root 16 Jan 30 10:20 /etc/security/su-dbadmins-access

Configure PAM by editing the file /etc/pam.d/su

sudo vim /etc/pam.d/su

Adding the following lines:

auth  required    pam_wheel.so use_uid group=sysadmins
auth  required    pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-sysadmins-access

auth  required    pam_wheel.so use_uid group=dbadmins
auth  required    pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-dbadmins-access

What the changes mean:

• Members of sysadmins group (admin1) may only su to root user.
• Members of dbadmins (dbuser1) may only su to postgres and oracle

Step 3: Testing su PAM policies

Log in as admin1 user and use su to try and change UID to a permitted root user.

$ ssh admin1@localhost
[admin1@centos ~]$  su - root #enter root user password
Password:
Last login: Sat Jan 30 10:17:26 UTC 2021 from 172.20.11.12 on pts/0
[root@centos ~]# exit
logout

Log in as dbuser1 user and use su to try and change UID to a permitted postgres user.

$ ssh dbuser1@localhost
$ su - postgres # the user should exist before

# Or
$ su - oracle

Log in as testuser1 user and try any su – it should fail

$ ssh testuser1@localhost
$ su - root
Password:
su: Permission denied
$ su - postgres

You’ve now secured access to root user using su command.