Linux 禁止普通用戶su到root


Linux賬戶權限管理上為了防止普通用戶通過su切換到root用戶,需要修改/etc/pam.d/su和/etc/login.defs兩個配置文件。

Step1:修改 /etc/pam.d/su文件

[root@ess ~]# vi /etc/pam.d/su
#%PAM-1.0
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid   //取消該行前的注釋
auth substack system-auth
auth include postlogin
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
"/etc/pam.d/su" 14L, 540C
#%PAM-1.0
auth sufficient pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth sufficient pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth required pam_wheel.so use_uid
auth substack system-auth
auth include postlogin
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session include postlogin
session optional pam_xauth.so

Step2:修改/etc/login.defs,末尾追加SU_WHEEL_ONLY yes

#
# If defined, this command is run when removing a user.
# It should remove any at/cron/print jobs etc. owned by
# the user to be removed (passed as the first argument).
#
#USERDEL_CMD /usr/sbin/userdel_local

#
# If useradd should create home directories for users by default
# On RH systems, we do. This option is overridden with the -m flag on
# useradd command line.
#
CREATE_HOME yes

# The permission mask is initialized to this value. If not specified,
# the permission mask will be initialized to 022.
UMASK 077

# This enables userdel to remove user groups if no members exist.
#
USERGROUPS_ENAB yes

# Use SHA512 to encrypt password.
ENCRYPT_METHOD SHA512
SU_WHEEL_ONLY yes

Step3:使用普通賬戶登錄系統進行su測試

[tom@ess ~]$ su -
密碼:
su: 拒絕權限
[tom@ess ~]$

說明:其他需要有權限root的用戶需要添加至wheel組中,如下圖:

[root@ess ~]# usermod -G wheel networking

[root@ess ~]# id networking
uid=1001(networking) gid=1001(networking) 組=1001(networking),10(wheel)
[root@ess ~]#


免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM