[Freeipa-users] local root can su to any IPA user

[Fred van Zwieten]

Hi,

When being root on an ipa-client, I can su to any IPA user. This is
somewhat unexptected behaviour in comparison to Windows. If I am local
administrator in a windows AD member server, I cannot become a domain user.
I need to be domain administrator for that.

Is it possible to have this "feature" disabled somehow?

Fred
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20131129/aa455f5a/attachment.htm>