User can't "su -" to root


 
Thread Tools Search this Thread
Operating Systems Linux User can't "su -" to root
# 1  
Old 01-18-2017
User can't "su -" to root

Hello.

I have a RHEL 7.2 where a regular user can't make a "su -" to reach root account:
Code:
server532:t711740:/$ id
uid=75456(t711740) gid=10000(personales) groups=10000(personales),10(wheel)

tehrh532:t711740:/$ su -
Password:
su: Permission denied

But can make "sudo su -"
Code:
server532:t711740:/$ sudo su -
[sudo] password for t711740:

server532:root:/root# id
uid=0(root) gid=0(root) groups=0(root),70000(emergencia)

What could be the problem? Any idea?
Code:
server532:root:/root# grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash

server532:root:/root# cat /etc/securetty
console
vc/1
vc/2
vc/3
vc/4
vc/5
vc/6
tty0
tty1
tty2
tty3
tty4
tty5
tty6

server532:root:/root# cat /etc/pam.d/su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth            required        pam_wheel.so group=wheel root_only use_uid
auth            include         system-auth-su
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         optional        pam_mkhomedir.so skel=/etc/skel/ umask=0022
session         include         system-auth
session         optional        pam_xauth.so

server532:root:/root# ls -l /bin/su
-rwsr-xr-x. 1 root root 32072 Aug 21  2015 /bin/su

# 2  
Old 01-18-2017
Hi,
- what is in system-auth-su ?
- Can we exclude the obvious difference that in the first case the root password must be entered and in the second case the user password?
# 3  
Old 01-18-2017
Code:
server532:root:/etc/pam.d# cat system-auth-su
auth     required       pam_env.so
auth     sufficient     pam_fprintd.so
unlock_time=600
auth     sufficient     pam_unix.so nullok try_first_pass
auth     sufficient     pam_ldap.so try_first_pass ignore_unknown_user
auth     [default=die] pam_faillock.so authfail audit deny=5 unlock_time=600
auth     sufficient pam_faillock.so authsucc audit deny=5 unlock_time=600
auth     required       pam_deny.so

account  required       pam_unix.so
account  sufficient     pam_localuser.so
account  sufficient     pam_succeed_if.so uid < 1000 quiet
account  required       pam_permit.so

password   required     pam_cracklib.so try_first_pass retry=3 minlen=8 dcredit=-1 lcredit=-1
password   sufficient   pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5
password   required     pam_deny.so

session optional        pam_keyinit.so revoke
session required        pam_limits.so
session [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
session required        pam_unix.so

Quote:
- Can we exclude the obvious difference that in the first case the root password must be entered and in the second case the user password?
Yes, we can exclude it.
Login or Register to Ask a Question

Previous Thread | Next Thread

9 More Discussions You Might Find Interesting

1. UNIX for Beginners Questions & Answers

How to run root level command , if user has "su -" permission in sudoers provided?

I am looking t run root level command on multiple servers, but all servers have only "su - " permission available in sudoers. please help me if any way that I can run command using help of "su -" My script for hosts in `cat hosts.txt`; do echo "###########################Server Name-... (5 Replies)
Discussion started by: yash_message
5 Replies

2. Shell Programming and Scripting

Root running a script calling to scp using user "xyz" is not authenticating!

Close duplicate thread. (0 Replies)
Discussion started by: denissi
0 Replies

3. AIX

Change "root" to "root.admin" in outgoing e-mails

Our AIX servers send e-mails which have the "from" address set to "root@company.com" for our root user ("C{M}company.com" in /etc/sendmail.cf). The problem is that when bad e-mails are sent out or rejected by remote servers, they are being returned and delivered to e-mail box of "Mary Root". ... (2 Replies)
Discussion started by: kah00na
2 Replies

4. Solaris

"! bad user (root)" in cron log

I am getting the following error in the cron log: ! bad user (root) Wed Sep 22 14:30:00 2010 < root 8989 c Wed Sep 22 14:30:00 2010 rc=1 What does this mean? (5 Replies)
Discussion started by: jastanle84
5 Replies

5. UNIX for Advanced & Expert Users

How to allow particular user only to login as a root using "ssh" ?

Q1 I want to allow particular user only to login into root using ssh. I have set PermitRootLogin no for security purpose but I want to allow some of the users to login as a root using ssh how to do this? I have tried with Allowusers user1 user2 its working for only the user1 and... (3 Replies)
Discussion started by: ungalnanban
3 Replies

6. Red Hat

error"warning: user owen does not exist - using root"?

I am trying to install openmotif22-2.2.3-18.src.rpm, after I typed in " rpm -i openmotif22-2.2.3-18.src.rpm" the following message comes out: warning: user owen does not exist - using root warning: group owen does not exist - using root I am install openmotif under root account. Do... (2 Replies)
Discussion started by: fishwater00
2 Replies

7. UNIX for Dummies Questions & Answers

Possible to give non root user sudo to "crontab -l"

Does anyone know if this is possible? I want to give some users access to root's crontab but only with a read privilege. Is this possible to do or can only root or people with full root sudo view root's cron? (4 Replies)
Discussion started by: LordJezoX
4 Replies

8. Solaris

sendmail "root... User address required." error

I'm running sendmail (8.13.8+Sun/8.13.8/Submit) solaris 10. When I send mail to root at the command line (whether I use a full-qualified address or just root), I get the error message root... User address required. Sending mail to root (either at the command line or in a cron job),... (10 Replies)
Discussion started by: csgonan
10 Replies

9. HP-UX

Creating a "semi" root user? Is it possible?

Hello All, I work as a system admin at a company of about 600 users on a HP-UX server. We have an IT department of about 15. My problem is that we give out the root password to the majority of them, they are phone support techs, as they need to get in to kill processes and setup users and... (4 Replies)
Discussion started by: Setan
4 Replies
Login or Register to Ask a Question