Light Sudo lockdown

[Rwac]

I have a group that has super user privileges (/etc/sudoers ALL etc..) (which will be locked down slowly).

How can you stop users switching to other users account (thus stopping audit trail)?

Stop them from using the su command?

 

[FirebarUK]

Hello

Right, check out /etc/pam.d/su and uncomment:

auth required pam_wheel.so use_uid

Add your users to the wheel group.

Root by default is a member of the wheel group, so you could then remove root from this group. Although, I'm unsure if that would break anything...

You might also want to look at creating a command specification in sudo and blocking it that way...

 

[Rwac]

Why aren't you sipping coctails by the beach!



Thanks! It's all kicking off here

Hello

Right, check out /etc/pam.d/su and uncomment:

auth required pam_wheel.so use_uid

Add your users to the wheel group.

Root by default is a member of the wheel group, so you could then remove root from this group. Although, I'm unsure if that would break anything...

You might also want to look at creating a command specification in sudo and blocking it that way...