How to prevent user to su without loading the .profile

[LoYeah]

Hi,

Is there any solution that can prevent user to su without loading the .profile. i.e su user will not exec the .profile.

Thanks

 

[baanman]

Try su username

Baanman

 

[jpor]

Yep.

su - username will invoke that users .profile.

su username will NOT invoke that users .profile

 

[LoYeah]

Hi all,

Because of security reason, we need to restrict the use of su username. It there any method I can do?

 

[baanman]

you can restrict to su to a user with smit.
set 'Another user can SU TO USER?' false from change show characteristics of a user.

Baanman

 

[theycallmetim]

Set an alias in /etc/profile

alias su="su -"

 

[needcoffee]

Instead of aliasing su="su -" which will not get your intended result, why not alias su as a different command so that users will not know to use the - flag? Or why not create a program or script with another name so that the - flag cannot be used? You could then audit the users' history and make sure they are not using su improperly.

needcoffee

 

[LoYeah]

thanks all of you