5.2.7 Ensure access to the su command is restricted
PARENT : CIS _5_Configure privilege escalation Main | 2.1.7-Ensure access to the su command is restricted
Draft
Assessment Status
Automated
Applicable Profiles
Level 1 - Server
Level 1 - Workstation
Description
WARNING: The contents of this section may not render correctly in the Word Export
The su command allows a user to run a command or shell as another user. The program has been superseded by sudo, which allows for more granular control over privileged access. Normally, the su command can be executed by any user. By uncommenting the pam_wheel.so statement in /etc/pam.d/su, the su command will only allow users in a specific groups to execute su. This group should be empty to reinforce the use of sudo for privileged access.
Rationale Statement
WARNING: The contents of this section may not render correctly in the Word Export
Restricting the use of su , and using sudo in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via sudo , whereas su can only record that a user executed the su program.
Impact Statement
Audit Procedure
WARNING: The contents of this section may not render correctly in the Word Export
Run the following command:
# grep -Pi '^\h*auth\h+(?:required|requisite)\h+pam_wheel\.so\h+(?:[^#\n\r]+\h+)?((?!\2)(use_uid\b|group=\H+\b))\h+(?:[^#\n\r]+\h+)?((?!\1)(use_uid\b|group=\H+\b))(\h+.*)?$' /etc/pam.d/su
Verify the output matches:
auth required pam_wheel.so use_uid group=<group_name>
Run the following command and verify that the group specified in <group_name> contains no users:
# grep <group_name> /etc/group
5.2.7 Ensure access to the su command is restricted
PARENT : CIS _5_Configure privilege escalation Main | 2.1.7-Ensure access to the su command is restricted
Draft
Assessment Status
Automated
Applicable Profiles
Level 1 - Server
Level 1 - Workstation
Description
WARNING: The contents of this section may not render correctly in the Word Export
The su command allows a user to run a command or shell as another user. The program has been superseded by sudo, which allows for more granular control over privileged access. Normally, the su command can be executed by any user. By uncommenting the pam_wheel.so statement in /etc/pam.d/su, the su command will only allow users in a specific groups to execute su. This group should be empty to reinforce the use of sudo for privileged access.
Rationale Statement
WARNING: The contents of this section may not render correctly in the Word Export
Restricting the use of su , and using sudo in its place, provides system administrators better control of the escalation of user privileges to execute privileged commands. The sudo utility also provides a better logging and audit mechanism, as it can log each command executed via sudo , whereas su can only record that a user executed the su program.
Impact Statement
Audit Procedure
WARNING: The contents of this section may not render correctly in the Word Export
Run the following command:
# grep -Pi '^\h*auth\h+(?:required|requisite)\h+pam_wheel\.so\h+(?:[^#\n\r]+\h+)?((?!\2)(use_uid\b|group=\H+\b))\h+(?:[^#\n\r]+\h+)?((?!\1)(use_uid\b|group=\H+\b))(\h+.*)?$' /etc/pam.d/su
Verify the output matches:
auth required pam_wheel.so use_uid group=<group_name>
Run the following command and verify that the group specified in <group_name> contains no users:
# grep <group_name> /etc/group
Verify the output does not contain any users in the relevant group:
<group_name>
<GID>:
Remediation Procedure
Create an empty group that will be specified for use of the su command. The group should be named according to site policy.
Example:
# groupadd sugroup
Add the following line to the /etc/pam.d/su file, specifying the empty group:
auth required pam_wheel.so use_uid group=sugroup
Verify the output does not contain any users in the relevant group:
<group_name>
<GID>:
Remediation Procedure
Create an empty group that will be specified for use of the su command. The group should be named according to site policy.
Example:
# groupadd sugroup
Add the following line to the /etc/pam.d/su file, specifying the empty group:
auth required pam_wheel.so use_uid group=sugroup
<GID>: