Dimejo hat geschrieben:Versuch es mal damit:
Das wechselt nicht nur zum Benutzer root, es stellt Dir auch die komplette Shell zur Verfügung, wie wenn Du Dich lokal anmeldest.
Das funktioniert. Was heisst das nun? Ich füge mal ein Auszug aus der /etc/passwd hinzu
Code: Alles auswählen
root:x:0:0:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
xyz:*:10004:10002:Stefan Harbich:/home/xyz:/bin/bash
...
und meine /etc/pam.d/su
Code: Alles auswählen
#
# The PAM configuration file for the Shadow `su' service
#
# This allows root to su without passwords (normal operation)
auth sufficient pam_rootok.so
# Uncomment this to force users to be a member of group root
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "root" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth required pam_wheel.so
# Uncomment this if you want wheel members to be able to
# su without a password.
# auth sufficient pam_wheel.so trust
# Uncomment this if you want members of a specific group to not
# be allowed to use su at all.
# auth required pam_wheel.so deny group=nosu
# Uncomment and edit /etc/security/time.conf if you need to set
# time restrainst on su usage.
# (Replaces the `PORTTIME_CHECKS_ENAB' option from login.defs
# as well as /etc/porttime)
# account requisite pam_time.so
# This module parses environment configuration file(s)
# and also allows you to use an extended config
# file /etc/security/pam_env.conf.
#
# parsing /etc/environment needs "readenv=1"
session required pam_env.so readenv=1
# locale variables are also kept into /etc/default/locale in etch
# reading this file *in addition to /etc/environment* does not hurt
session required pam_env.so readenv=1 envfile=/etc/default/locale
# Defines the MAIL environment variable
# However, userdel also needs MAIL_DIR and MAIL_FILE variables
# in /etc/login.defs to make sure that removing a user
# also removes the user's mail spool file.
# See comments in /etc/login.defs
#
# "nopen" stands to avoid reporting new mail when su'ing to another user
session optional pam_mail.so nopen
# Sets up user limits, please uncomment and read /etc/security/limits.conf
# to enable this functionality.
# (Replaces the use of /etc/limits in old login)
# session required pam_limits.so
# The standard Unix authentication modules, used with
# NIS (man nsswitch) as well as normal /etc/passwd and
# /etc/shadow entries.
@include common-auth
@include common-account
@include common-session
Dazu lege ich Euch noch meine /etc/pam.d/common-auth
Code: Alles auswählen
#
# /etc/pam.d/common-auth - authentication settings common to all services
#
# This file is included from other service-specific PAM config files,
# and should contain a list of the authentication modules that define
# the central authentication scheme for use on the system
# (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the
# traditional Unix authentication mechanisms.
#
# As of pam 1.0.1-6, this file is managed by pam-auth-update by default.
# To take advantage of this, it is recommended that you configure any
# local modules either before or after the default block, and use
# pam-auth-update to manage selection of other modules. See
# pam-auth-update(8) for details.
##
auth sufficient pam_unix.so nullok_secure
auth requisite pam_succeed_if.so uid >= 1000 quiet
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so
##
auth [success=1 default=ignore] pam_ldap.so
auth required pam_unix.so try_first_pass
auth required pam_permit.so
#auth [success=2 default=ignore] pam_unix.so nullok_secure try_first_pass
#auth [success=1 default=ignore] pam_ldap.so use_first_pass
#auth requisite pam_deny.so
#auth required pam_permit.so
## auth sufficient pam_unix.so
## auth sufficient pam_ldap.so minimum_uid=1000 use_first_pass
## auth required pam_deny.so
auth required pam_access.so
Dann benötigt Ihr noch die /etc/security/access.conf
Code: Alles auswählen
# disallow all except people in the login group and root
-:ALL EXCEPT root login:ALL EXCEPT LOCAL
Ich hoffe Ihr könnt mir weiterhelfen?
Lieben Gruß von Stefan Harbich
