Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm trying to edit /etc/sudoers via visudo, but I don't know how to change the root rights.

I want root to be prompted for the user1's password, when he tries to use su user1.

share|improve this question
7  
I doubt this is possible, and it doesn't make sense. Why do you want root to be prompted for user1's password? It doesn't actually protect user1's account from root when root doesn't know the password. – Shawn J. Goff Oct 28 '12 at 17:08
Maybe this is useless. This is just a question from a lab in my university. I guess this is possible, because you can indicate a user the the commands he can use without password. For instance : gatoatigrado ALL=NOPASSWD: /bin/set-slow-cpufreq – ice_mint Oct 28 '12 at 17:15
Ah, I see. So you could probably exclude su from the ALL tag to make this work. – Shawn J. Goff Oct 28 '12 at 17:22
sudo and su are 2 completely different commands. Nothing you do to /etc/sudoers will have any impact on how the su command behaves. – Cry Havok Oct 28 '12 at 17:25
Well, I added a new line to the the /etc/sudoers: root ALL = (ALL:ALL) PASSWD:/usr/bin/su. Unfortunately still not working:( – ice_mint Oct 28 '12 at 17:26
show 5 more comments

3 Answers

up vote 3 down vote
  1. root never needs a password to do anything. root is an all powerful user. root=superuser=administrator=chucknorris
  2. as @Cry Havok pointed out /etc/sudoers has nothing to do with su, only sudo

SIDENOTE: running su - <user> as a regular user (non-root/unprivileged) will always ask for a password.

share|improve this answer
up vote 2 down vote

Well, it's not really a good idea, but it IS possible. As somebody here pointed out, you can't prevent root from being the computer's god, but you can modify the "su" program to ask for passwords. It can prevent root from re-logging to other accounts unless he compiles his own version of su and uses it.

First, you'll need a compiler to be able to re-build su. As a root, perform:

apt-get install build-essential

Then, download and prepare the GNU Coreutils:

ftp://ftp.task.gda.pl/pub/gnu/coreutils/coreutils-8.13.tar.gz
tar xvf coreutils-8.20.tar.xz
cd coreutils-8.20
./configure

Now access the src directory and locate the su.c file. In line 223, you'll find:

if (getuid () == 0 || !correct || correct[0] == '\0')

Change it to:

if (!correct || correct[0] == '\0')

Now, back in the coreutils-8.20 directory, run make. Compilation might take long time. Once it's done, overwrite the current su binary with the new one:

cp src/su `which su`

And again - you're doing it wrong.

share|improve this answer
up vote 0 down vote

Root can become any user without requiring any authentication. Even if the su command was configured to prompt for a password, root could use some other program to issue the underlying system call. The su command is normally configured not to require a password because it's useless for security, and a lot of non-interactive scripts rely on that to perform tasks as a less privileged user.

On Ubuntu (and many other systems that use PAM), the absence of a password prompt when root runs su is implemented by the following line in /etc/pam.d/su:

auth       sufficient pam_rootok.so

Note that sudo and su are completely different programs. You can't change the behavior of su by changing the configuration of sudo.

share|improve this answer
Ok, I see. My question was just to ensure minimum security for su acces,even if this is not efective for sudo, like d33tah pointed. – ice_mint Oct 31 '12 at 1:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.