8

Restrict su access to Privileged Accounts in Linux

 3 years ago
source link: https://computingforgeeks.com/restrict-su-access-to-privileged-accounts-linux/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
neoserver,ios ssh client
Restrict su access to Privileged Accounts in Linux

How can I limit the use of su command on Linux to only Privileged Accounts such as Admin user group?. The su utility requests appropriate user credentials via PAM and switches to that user ID (the default user is the superuser). In this article we will look at how to configure pam to restrict su to some users only in a Linux system.

We will create a group and restrict use of su to the users in the group. PAM is used to set the policy that the su will use. It can be configured to allow different groups of users access to specific target UIDs through su. The PAM modules required for this operation are:

  • pam_succeed_if
  • pam_wheel.so
  • pam_listfile.so

What we will accomplish by the end of this guide:

  • Create a Linux group call sysadmins
  • Configure PAM to permit users from a group permission to use su
  • Switching as any other user with su will fail

Step 1: Create groups and add users

Let’s start by creating two Linux groups, sysadmins and dbadmins

sudo groupadd sysadmins
sudo groupadd dbadmins

Create three users, one called admin1, another called dbuser1 and lastly testuser1

# Create admin1 user
$ sudo useradd admin1
$ sudo passwd admin1

# Create dbuser1
$ sudo useradd dbuser1
$ sudo passwd dbuser1

# Create testuser1
$ sudo useradd testuser1
$ sudo passwd testuser1

Assign admin1 user to sysadmins group.

sudo usermod -G sysadmins admin1

Assign dbuser1 user to dbadmins group.

sudo usermod -G dbadmins dbuser1

Confirm the users is correctly assigned to the relevant groups by checking the output of getent:

$ getent group sysadmins
sysadmins:x:1001:admin1

$ getent group dbadmins
dbadmins:x:1002:dbuser1

Step 2: Configure su PAM Policy

Create a new file /etc/security/su-sysadmins-access file and add the target UIDs that users in the sysadmins group are allowed to access using su command:

$ sudo vim /etc/security/su-sysadmins-access
root

Create another file /etc/security/su-dbadmins-access and add the target UIDs that users in the dbadmins group are allowed to access using su command:

$ sudo vim /etc/security/su-dbadmins-access
postgres
oracle

Limit write access of the file created to only root user.

sudo chown root:root /etc/security/su-sysadmins-access
sudo chown root:root /etc/security/su-dbadmins-access

sudo chmod 0644 /etc/security/su-sysadmins-access
sudo chmod 0644 /etc/security/su-dbadmins-access

Confirm permissions:

$ ls -lh /etc/security/su-sysadmins-access
-rw-r--r--. 1 root root 5 Jan 30 10:19 /etc/security/su-sysadmins-access

$ ls -lh /etc/security/su-dbadmins-access
-rw-r--r--. 1 root root 16 Jan 30 10:20 /etc/security/su-dbadmins-access

Configure PAM by editing the file /etc/pam.d/su

$ sudo vim /etc/pam.d/su

Adding the following lines:

auth              [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup sysadmins
auth  required    pam_wheel.so use_uid group=sysadmins
auth  required    pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-sysadmins-access
auth              [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup dbadmins
auth  required    pam_wheel.so use_uid group=dbadmins
auth  required    pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-dbadmins-access

What the changes mean:

  • Members of sysadmins group (admin1) may only su to root user.
  • Members of dbadmins (dbuser1) may only su to postgres and oracle

This is how by su file looks like:

#%PAM-1.0
auth              sufficient     pam_rootok.so
auth              [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup sysadmins
auth  required    pam_wheel.so use_uid group=sysadmins
auth  required    pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-sysadmins-access
auth              [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup dbadmins
auth  required    pam_wheel.so use_uid group=dbadmins
auth  required    pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-dbadmins-access
auth              include        system-auth
account           sufficient     pam_succeed_if.so uid = 0 use_uid quiet
account           include        system-auth
password          include        system-auth
session           include        system-auth
session           optional       pam_xauth.so

Step 3: Testing su PAM policies

Log in as admin1 user and use su to try and change UID to a permitted root user.

$ ssh admin1@localhost
[admin1@centos ~]$  su - root #enter root user password
Password:
Last login: Sat Jan 30 10:17:26 UTC 2021 from 172.20.11.12 on pts/0
[root@centos ~]# exit
logout

Log in as dbuser1 user and use su to try and change UID to a permitted postgres user.

$ ssh dbuser1@localhost
$ su - postgres # the user should exist before

# Or
$ su - oracle

Log in as testuser1 user and try any su – it should fail

$ ssh testuser1@localhost
$ su - root
$ su - postgres

report

Recommend

About Joyk


Aggregate valuable and interesting links.
Joyk means Joy of geeK