User can't "su -" to root Post: 302989803

Sponsored Content

Operating Systems Linux User can't "su -" to root Post 302989803 by Gabriander on Wednesday 18th of January 2017 11:58:47 AM

01-18-2017

Registered User

User can't "su -" to root

Hello.

I have a RHEL 7.2 where a regular user can't make a "su -" to reach root account:

Code:

server532:t711740:/$ id
uid=75456(t711740) gid=10000(personales) groups=10000(personales),10(wheel)

tehrh532:t711740:/$ su -
Password:
su: Permission denied

But can make "sudo su -"

Code:

server532:t711740:/$ sudo su -
[sudo] password for t711740:

server532:root:/root# id
uid=0(root) gid=0(root) groups=0(root),70000(emergencia)

What could be the problem? Any idea?

Code:

server532:root:/root# grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash

server532:root:/root# cat /etc/securetty
console
vc/1
vc/2
vc/3
vc/4
vc/5
vc/6
tty0
tty1
tty2
tty3
tty4
tty5
tty6

server532:root:/root# cat /etc/pam.d/su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth            required        pam_wheel.so group=wheel root_only use_uid
auth            include         system-auth-su
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         optional        pam_mkhomedir.so skel=/etc/skel/ umask=0022
session         include         system-auth
session         optional        pam_xauth.so

server532:root:/root# ls -l /bin/su
-rwsr-xr-x. 1 root root 32072 Aug 21  2015 /bin/su

Gabriander

View Public Profile for Gabriander

Find all posts by Gabriander

9 More Discussions You Might Find Interesting

1. HP-UX

Creating a "semi" root user? Is it possible?

Hello All, I work as a system admin at a company of about 600 users on a HP-UX server. We have an IT department of about 15. My problem is that we give out the root password to the majority of them, they are phone support techs, as they need to get in to kill processes and setup users and...

2. Solaris

sendmail "root... User address required." error

I'm running sendmail (8.13.8+Sun/8.13.8/Submit) solaris 10. When I send mail to root at the command line (whether I use a full-qualified address or just root), I get the error message root... User address required. Sending mail to root (either at the command line or in a cron job),...

3. UNIX for Dummies Questions & Answers

Possible to give non root user sudo to "crontab -l"

Does anyone know if this is possible? I want to give some users access to root's crontab but only with a read privilege. Is this possible to do or can only root or people with full root sudo view root's cron?

4. Red Hat

error"warning: user owen does not exist - using root"?

I am trying to install openmotif22-2.2.3-18.src.rpm, after I typed in " rpm -i openmotif22-2.2.3-18.src.rpm" the following message comes out: warning: user owen does not exist - using root warning: group owen does not exist - using root I am install openmotif under root account. Do...

5. UNIX for Advanced & Expert Users

How to allow particular user only to login as a root using "ssh" ?

Q1 I want to allow particular user only to login into root using ssh. I have set PermitRootLogin no for security purpose but I want to allow some of the users to login as a root using ssh how to do this? I have tried with Allowusers user1 user2 its working for only the user1 and...

6. Solaris

"! bad user (root)" in cron log

I am getting the following error in the cron log: ! bad user (root) Wed Sep 22 14:30:00 2010 < root 8989 c Wed Sep 22 14:30:00 2010 rc=1 What does this mean?

7. AIX

Change "root" to "root.admin" in outgoing e-mails

Our AIX servers send e-mails which have the "from" address set to "root@company.com" for our root user ("C{M}company.com" in /etc/sendmail.cf). The problem is that when bad e-mails are sent out or rejected by remote servers, they are being returned and delivered to e-mail box of "Mary Root". ...

8. Shell Programming and Scripting

Root running a script calling to scp using user "xyz" is not authenticating!

Close duplicate thread.

9. UNIX for Beginners Questions & Answers

How to run root level command , if user has "su -" permission in sudoers provided?

I am looking t run root level command on multiple servers, but all servers have only "su - " permission available in sudoers. please help me if any way that I can run command using help of "su -" My script for hosts in `cat hosts.txt`; do echo "###########################Server Name-...

LEARN ABOUT LINUX

pam_rootok

PAM_ROOTOK(8)							 Linux-PAM Manual						     PAM_ROOTOK(8)

NAME

       pam_rootok - Gain only root access

SYNOPSIS

       pam_rootok.so [debug]

DESCRIPTION

       pam_rootok is a PAM module that authenticates the user if their UID is 0. Applications that are created setuid-root generally retain the
       UID of the user but run with the authority of an enhanced effective-UID. It is the real UID that is checked.

OPTIONS

       debug
	   Print debug information.

MODULE TYPES PROVIDED

       The auth, acct and password module types are provided.

RETURN VALUES

       PAM_SUCCESS
	   The UID is 0.

       PAM_AUTH_ERR
	   The UID is not 0.

EXAMPLES

       In the case of the su(1) application the historical usage is to permit the superuser to adopt the identity of a lesser user without the use
       of a password. To obtain this behavior with PAM the following pair of lines are needed for the corresponding entry in the /etc/pam.d/su
       configuration file:

	   # su authentication. Root is granted access by default.
	   auth  sufficient   pam_rootok.so
	   auth  required     pam_unix.so

SEE ALSO

       su(1), pam.conf(5), pam.d(5), pam(7)

AUTHOR

       pam_rootok was written by Andrew G. Morgan, <morgan@kernel.org>.

Linux-PAM Manual						    06/04/2011							     PAM_ROOTOK(8)

9 More Discussions You Might Find Interesting

1. HP-UX

Creating a "semi" root user? Is it possible?

Discussion started by: Setan

2. Solaris

sendmail "root... User address required." error

Discussion started by: csgonan

3. UNIX for Dummies Questions & Answers

Possible to give non root user sudo to "crontab -l"

Discussion started by: LordJezoX

4. Red Hat

error"warning: user owen does not exist - using root"?

Discussion started by: fishwater00

5. UNIX for Advanced & Expert Users

How to allow particular user only to login as a root using "ssh" ?

Discussion started by: ungalnanban

6. Solaris

"! bad user (root)" in cron log

Discussion started by: jastanle84

7. AIX

Change "root" to "root.admin" in outgoing e-mails

Discussion started by: kah00na

8. Shell Programming and Scripting

Root running a script calling to scp using user "xyz" is not authenticating!

Discussion started by: denissi

9. UNIX for Beginners Questions & Answers

How to run root level command , if user has "su -" permission in sudoers provided?

Discussion started by: yash_message

LEARN ABOUT LINUX

pam_rootok