su groups

[phorbiuz]

I'm further tying down on our AIX 5.3 systems access to root. I'm going to create a new group containing the id's that will be allowed to su to root, with most other accounts on the system still being able to su to other accounts, just not root.

Obviously for this to work I have to add this new group to root's 'su groups' field. At present this is set to ALL.

Can anyone tell me which groups should be listed for root in this field for AIX to continue to run smoothly?

Thanks.

 

[DukeSSD]

It sounds to me like you need to check out the aixpert command instead of trying to write the book your self where you run the risk of leaving any number of major security loop holes.

 

[ogniemi]

maybe sudo you can configure for your purposes?

 

[bbrk364]

To Disallow su to root add the group !su to each of the users