users who can be root 1

[Mag0007]

Similar to

http://www.tek-tips.com/viewthread.cfm?qid=1030992&page=1

Is it possible to find out, what users have "su - root" ability, and what users have been "su - root" to root recently?

 

[ggauthier]

Anyone can type in "su - root"

If you are trying to limit who can do this successfully, create a group of allowed users (e.g., "rootusers") and then set the "sugroups" attribute for the root account.

chuser sugroups=rootusers root

This limits access to those people who know the root password and are a member of that group.

You should also set rlogin=false for root, and other considerations in your referenced topic.

Regarding what "what users have been to 'su - root' recently" you can check that in the /var/adm/sulog
grep root /var/adm/sulog

gg

 

[Mag0007]

thanks! got it!

 

[KenCunningham]

An interesting discussion, thanks. I'm from a mainly Solaris background so all of this is somewhat new to me.

 

[hfaix]

I use the method ggauthier describes for all "higher authority" users. For example, "DBA" accounts.

You can also make the chuser change through smit user (change characteristics).