passwordless su

D

dbi

Hi,

How to set the "wheel" group members (and/or any other explicitly named group) to do "su" w/o password?

In GNU/Linux it is can be achieved by "pam_wheel", e.g.:

Code: 
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
auth            sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth            required        pam_wheel.so use_uid
auth            include         system-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so
 
Visudo is for administring sudo access, it has nothing to do with su.

You cannot have a password-less su.
 
in /etc/pam.d/su comment out the line containing auth and system e.g.
Code: 
auth		requisite	pam_group.so		no_warn group=wheel root_only fail_safe
#auth		include		system
pam_group(8) line should be enough to restrict access to only "wheel" group
 
Galactic_Dominator said:
You can if the root passwd is blank
Click to expand...
Definitely not recommended. And I don't recommend a password-less su or sudo either.
 
luna said:
in /etc/pam.d/su comment out the line containing auth and system e.g.
Code: 
auth		requisite	pam_group.so		no_warn group=wheel root_only fail_safe
#auth		include		system
pam_group(8) line should be enough to restrict access to only "wheel" group
Click to expand...

Doesn't work here?
 
Uhm, why would you want a password-less su command? That's just asking for a rooting.

Install sudo and use that. At least then you can lock it down to specific commands that can be run as root without requiring a password.

But allowing people to become root without a password? That's madness.
 
phoenix said:
Uhm, why would you want a password-less su command? That's just asking for a rooting.

Install sudo and use that. At least then you can lock it down to specific commands that can be run as root without requiring a password.

But allowing people to become root without a password? That's madness.
Click to expand...

While being afraid the discussion would go off-topic, I believe those questions really deserve an answer.

At first glance the idea seems scary indeed, but actually it is all about convenience with no security reduction in this particular case.

- Who can do "switch user" (su)?
- The wheel members only.
- Who is a wheel member?
- No one but root and yours truly.
- Who has an ssh access?
- Another account with no "wheel" membership and no one else.

If someone cracked the dedicated ssh account, they could not do "su" from it. So, what's the point to enter the root's password every time I want to do an administrative task?

Finally, a few words about sudo.
I dislike sudo.
I like su.
I'd always prefer to type the root password before switching to sudo.

So, back to the original question: is FreeBSD capable of doing passwordless su?
 
Apart from the fact that sudo is an addon, what's the difference of su/sudo if sudo is limited to the wheel group only? With sudo set up you could even create a shortcut if you like
Code: 
alias su='sudo sh'
 
You must log in or register to reply here.
Back
Top