sudoers syntax

chuckuykendall · #1 (**permalink**) 04-27-2005

I'm stuck with a dilemma. I am trying to control userid's access to the su command in such a way that he will not be able to su to root (su, su -, su root, su - root) but he will be able to su to any other user. I have tried the following syntax:

Code:

userid  ALL=/usr/bin/su ?*, !/usr/bin/su *root*

This catches "su", "su root", and "su - root", but not "su -". I've also tried the follow syntax:

Code:

Cmnd_Alias  SU_TO_ROOT = /usr/bin/su, /usr/bin/su -, /usr/bin/su *root*, /usr/bin/su - *root*
userid  ALL=ALL, !SU_TO_ROOT

This catches all four types of su'ing to root but it also catches all other su attempts, which I would like to leave open. Any suggestions?

scottsl · #2 (**permalink**) 11-11-2005

While I've never tried this with *root*, you could make another group called sutoroot and add this to roots list of groups. Then (at least on AIX) you can restrict by group which groups are authorized to su to this user.

Just one thought

salam · #3 (**permalink**) 04-28-2009

You can filter the dash flag with [!-]*

See below:

Code:

# on the alphas, john may su to anyone but root and flags are not allowed
john        ALPHA = /usr/bin/su [!-]*, !/usr/bin/su *root*

(more examples on http://www.gratisoft.us/sudo/sample.sudoers)

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
sudoers	tjmannonline	UNIX for Dummies Questions & Answers	5	06-13-2009 04:12 AM
Sudoers problems.	blane	UNIX for Advanced & Expert Users	5	04-09-2008 05:18 PM
sudoers on HP 11.11	dhlopomo	UNIX for Dummies Questions & Answers	2	01-18-2008 06:03 AM
sudoers file	whatisthis	Linux	4	12-02-2004 05:59 PM
/etc/sudoers is mode 0660	pneumeric	UNIX for Dummies Questions & Answers	4	10-09-2003 01:14 AM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Switch to Linear Mode Hybrid Mode Switch to Threaded Mode	Rate This Thread:


	Powered by