I set public key authentication on my rpi and disabled password login in the sshd_config file. There are two users: userA and userB, while userA is my main user. In addition there are two computers (pc1 and pc2).

I created diffrent keys for both computers as usual. pc1 should be able to log in to both users. So I added his public key to both user's authorized_keys file.

pc2 shall not be able to log in to userA. That's why I added his public key only to userB's authorized_keys file.

Now if I try to log in from pc2 with $ ssh userA@hostname the permission is denied like I wanted, while log in to userB is allowed. Everything works greate so far.

But when I log in from pc2 to userB an run $ su userA I'm still able to access userA by just enter the password.

Is there a possibility to avoid this? I don't want pc2 to be able to log in on userA at all.

  • You could limit the execution permissions on su to a particular group and exclude userB, if it is okay that userB be completely unable to use su. – goldilocks Jul 14 '16 at 12:52
  • Sounds perfect, how do I do this? – timdelawe Jul 14 '16 at 13:12

There's a couple of ways you could prevent userB from using su period; the first one is via a mechanism provided by PAM; it may differ slightly from distro to distro but the description on current versions of Raspbian from /etc/pam.d/su is:

# Uncomment this to force users to be a member of group root
# before they can use `su'. You can also add "group=foo"
# to the end of this line if you want to use a group other
# than the default "root" (but this may have side effect of
# denying "root" user, unless she's a member of "foo" or explicitly
# permitted earlier by e.g. "sufficient pam_rootok.so").
# (Replaces the `SU_WHEEL_ONLY' option from login.defs)
# auth       required   pam_wheel.so

Since sufficient pam_rootok.so is probably already enabled (immediately above this part), if you would like to create a group and use that rather than putting other users who should have su access into group root, first create a new group:

sudo groupadd usesu

Then uncomment that line and edit a bit:

auth       required   pam_wheel.so group=usesu

I presume this should take effect right away. To add a user to the group, see the -a and -G options to man usermod; note that once added to a group you have to re-login for that to take effect.

If that doesn't seem to work, you can change the ownership and permissions on su directly:

sudo chgrp usesu $(which su)
sudo chmod 4750 $(which su)

The 4 at the beginning is for the setuid bit necessary to su's functioning, the 750 means read-write-execute for owner (root) and read-execute for group (usesu), nothing for anyone else.

  • The first way worked perfectly. I just added group=sudo, for only sudoers can use su. Thank you! – timdelawe Jul 15 '16 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.