<html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style>
</head>
<body ocsi="0" fpstyle="1">
<div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">Can I get this clarified as I am getting really confused,<br>
<br>
Can I do this in/via IPA or not?<br>
<br>
<div>Yes or no I think will suffice.<br>
<br>
<div style="font-family: Tahoma; font-size: 13px;">
<p>regards</p>
<p>Steven Jones</p>
<p>Technical Specialist - Linux RHCE</p>
<p>Victoria University, Wellington, NZ</p>
<p>0064 4 463 6272<br>
</p>
</div>
</div>
<div style="font-family: Times New Roman; color: rgb(0, 0, 0); font-size: 16px;">
<hr tabindex="-1">
<div style="direction: ltr;" id="divRpF28145"><font color="#000000" face="Tahoma" size="2"><b>From:</b> Arpit Tolani [arpittolani@gmail.com]<br>
<b>Sent:</b> Tuesday, 17 July 2012 11:13 p.m.<br>
<b>To:</b> Steven Jones<br>
<b>Cc:</b> Rob Crittenden; freeipa-users@redhat.com<br>
<b>Subject:</b> Re: [Freeipa-users] How to set a user group rule to allow su - oracle only?<br>
</font><br>
</div>
<div></div>
<div>Hello<br>
<br>
<div class="gmail_quote">On Tue, Jul 17, 2012 at 3:15 AM, Steven Jones <span dir="ltr">
<<a href="mailto:Steven.Jones@vuw.ac.nz" target="_blank">Steven.Jones@vuw.ac.nz</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-left: 1ex;">
Hi,<br>
<br>
If I login as say user1, I want that user to be able to su - oracle, but not to say su - root (or to any other user).<br>
<br>
If user2 logins I want them unable to su - X at all and especially not root.<br>
<br>
If an admin logins in I want them to be able to su - anybody...<br>
<br>
In a way before I could do that with the wheel group and pam.<br>
<div class="im"><br>
regards<br>
<br>
Steven Jones<br>
<div class="h5">rob<br>
</div>
</div>
</blockquote>
<br>
</div>
<span id="Page:form:CaseCommentEditors:j_id497:2:View">
<pre class="caseCommentStyle publicComment"># cat /etc/pam.d/su
auth sufficient pam_rootok.so
auth [default=1 success=ok ignore=ignore] pam_wheel.so trust use_uid group=group1
auth [success=2 default=die] pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group1-access
auth [default=die success=ok ignore=ignore] pam_wheel.so trust use_uid group=group2
auth requisite pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-group2-access
auth include system-auth
account sufficient pam_succeed_if.so uid = 0 use_uid quiet
account include system-auth
password include system-auth
session include system-auth
session optional pam_xauth.so</pre>
</span><br>
With above configuration.<br>
<br>
members of group1 will be able to su only to users in /etc/security/su-group1-access<br>
members of group2 will be able to su only to users in /etc/security/su-group2-access<span id="Page:form:CaseCommentEditors:j_id497:2:View"></span><span id="Page:form:CaseCommentEditors:j_id497:2:View"></span><br>
users which are not in group1 & group2 both will not be able to su to anyone<br>
root will be able to su to anyone<br>
<br>
Hope that helps, Change it as per your requirement.<br>
<br>
Regards<br>
Arpit Tolani<br>
</div>
</div>
</div>
</body>
</html>