Disabling sudo su in ubuntu 14.04 Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) sudo, su problemsWhy is sudo -s better than sudo su?What are the differences between “su”, “sudo -s”, “sudo -i”, “sudo su”?I can't do “sudo”sudo su doesn't change users for mysqlAccessing sudo from a non-administrator profileUbuntu sudo su and server su clarificationRe-disabling the root accountSudo and su simultaneously?sudo -i and sudo su - explained

When is phishing education going too far?

Can I throw a longsword at someone?

What items from the Roman-age tech-level could be used to deter all creatures from entering a small area?

Stop battery usage [Ubuntu 18]

Why does tar appear to skip file contents when output file is /dev/null?

How does modal jazz use chord progressions?

Replacing HDD with SSD; what about non-APFS/APFS?

Can a zero nonce be safely used with AES-GCM if the key is random and never used again?

How to market an anarchic city as a tourism spot to people living in civilized areas?

Is it possible to ask for a hotel room without minibar/extra services?

Problem when applying foreach loop

Complexity of many constant time steps with occasional logarithmic steps

How do I automatically answer y in bash script?

Autumning in love

Geometric mean and geometric standard deviation

If I can make up priors, why can't I make up posteriors?

How to say that you spent the night with someone, you were only sleeping and nothing else?

Slither Like a Snake

Determine whether f is a function, an injection, a surjection

Area of a 2D convex hull

What's the point in a preamp?

Blender game recording at the wrong time

Estimated State payment too big --> money back; + 2018 Tax Reform

How do I keep my slimes from escaping their pens?



Disabling sudo su in ubuntu 14.04



Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) sudo, su problemsWhy is sudo -s better than sudo su?What are the differences between “su”, “sudo -s”, “sudo -i”, “sudo su”?I can't do “sudo”sudo su doesn't change users for mysqlAccessing sudo from a non-administrator profileUbuntu sudo su and server su clarificationRe-disabling the root accountSudo and su simultaneously?sudo -i and sudo su - explained



.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;








4















I need to accomplish following things .



  1. Disable ubuntu user


  2. Disable sudo su for all user .


  3. Each user should able to execute sudo


I have modified my sudoer file as below



# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL


**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**


# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:


Still I can access sudo using the command

# sudo sudo su


How to disable this . Any help is highly apprciable . Thanks in advance .










share|improve this question
























  • Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.

    – vembutech
    Dec 19 '14 at 12:09











  • It did not work for me .

    – user1726453
    Dec 19 '14 at 12:54

















4















I need to accomplish following things .



  1. Disable ubuntu user


  2. Disable sudo su for all user .


  3. Each user should able to execute sudo


I have modified my sudoer file as below



# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL


**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**


# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:


Still I can access sudo using the command

# sudo sudo su


How to disable this . Any help is highly apprciable . Thanks in advance .










share|improve this question
























  • Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.

    – vembutech
    Dec 19 '14 at 12:09











  • It did not work for me .

    – user1726453
    Dec 19 '14 at 12:54













4












4








4


1






I need to accomplish following things .



  1. Disable ubuntu user


  2. Disable sudo su for all user .


  3. Each user should able to execute sudo


I have modified my sudoer file as below



# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL


**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**


# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:


Still I can access sudo using the command

# sudo sudo su


How to disable this . Any help is highly apprciable . Thanks in advance .










share|improve this question
















I need to accomplish following things .



  1. Disable ubuntu user


  2. Disable sudo su for all user .


  3. Each user should able to execute sudo


I have modified my sudoer file as below



# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root ALL=(ALL:ALL) ALL

# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL


**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**


# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:


Still I can access sudo using the command

# sudo sudo su


How to disable this . Any help is highly apprciable . Thanks in advance .







su






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Dec 19 '14 at 13:34









muru

1




1










asked Dec 19 '14 at 11:26









user1726453user1726453

21112




21112












  • Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.

    – vembutech
    Dec 19 '14 at 12:09











  • It did not work for me .

    – user1726453
    Dec 19 '14 at 12:54

















  • Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.

    – vembutech
    Dec 19 '14 at 12:09











  • It did not work for me .

    – user1726453
    Dec 19 '14 at 12:54
















Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.

– vembutech
Dec 19 '14 at 12:09





Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.

– vembutech
Dec 19 '14 at 12:09













It did not work for me .

– user1726453
Dec 19 '14 at 12:54





It did not work for me .

– user1726453
Dec 19 '14 at 12:54










3 Answers
3






active

oldest

votes


















8














With respect, if you get what you ask for and somebody can run sudo <anything but su>, they can:



  • Run sudo bash

  • Run sudo -i

  • Create a script that does something similar (including directly running su).

  • Just edit the configuration with sudo visudo

The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.



If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo) and add each command to sudoers, like so:



%semisudo localhost=/path/to/command
%semisudo localhost=/path/to/another/command


And then add the user to that group and kick them out of admin/sudo.






share|improve this answer

























  • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then

    – user1726453
    Dec 19 '14 at 12:36











  • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .

    – user1726453
    Dec 19 '14 at 12:46






  • 1





    @user1726453 and anyone having the same concern, see this answer on logging possibility after sudo su: unix.stackexchange.com/a/109836/30230

    – PF4Public
    Jun 3 '16 at 18:18


















0














Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.





share






























    -1














    I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .



    #root ALL=(ALL:ALL) ALL


    It is working for me . Thanks all for your help .






    share|improve this answer

























      Your Answer








      StackExchange.ready(function()
      var channelOptions =
      tags: "".split(" "),
      id: "89"
      ;
      initTagRenderer("".split(" "), "".split(" "), channelOptions);

      StackExchange.using("externalEditor", function()
      // Have to fire editor after snippets, if snippets enabled
      if (StackExchange.settings.snippets.snippetsEnabled)
      StackExchange.using("snippets", function()
      createEditor();
      );

      else
      createEditor();

      );

      function createEditor()
      StackExchange.prepareEditor(
      heartbeatType: 'answer',
      autoActivateHeartbeat: false,
      convertImagesToLinks: true,
      noModals: true,
      showLowRepImageUploadWarning: true,
      reputationToPostImages: 10,
      bindNavPrevention: true,
      postfix: "",
      imageUploader:
      brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
      contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
      allowUrls: true
      ,
      onDemand: true,
      discardSelector: ".discard-answer"
      ,immediatelyShowMarkdownHelp:true
      );



      );













      draft saved

      draft discarded


















      StackExchange.ready(
      function ()
      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f563275%2fdisabling-sudo-su-in-ubuntu-14-04%23new-answer', 'question_page');

      );

      Post as a guest















      Required, but never shown

























      3 Answers
      3






      active

      oldest

      votes








      3 Answers
      3






      active

      oldest

      votes









      active

      oldest

      votes






      active

      oldest

      votes









      8














      With respect, if you get what you ask for and somebody can run sudo <anything but su>, they can:



      • Run sudo bash

      • Run sudo -i

      • Create a script that does something similar (including directly running su).

      • Just edit the configuration with sudo visudo

      The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.



      If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo) and add each command to sudoers, like so:



      %semisudo localhost=/path/to/command
      %semisudo localhost=/path/to/another/command


      And then add the user to that group and kick them out of admin/sudo.






      share|improve this answer

























      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then

        – user1726453
        Dec 19 '14 at 12:36











      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .

        – user1726453
        Dec 19 '14 at 12:46






      • 1





        @user1726453 and anyone having the same concern, see this answer on logging possibility after sudo su: unix.stackexchange.com/a/109836/30230

        – PF4Public
        Jun 3 '16 at 18:18















      8














      With respect, if you get what you ask for and somebody can run sudo <anything but su>, they can:



      • Run sudo bash

      • Run sudo -i

      • Create a script that does something similar (including directly running su).

      • Just edit the configuration with sudo visudo

      The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.



      If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo) and add each command to sudoers, like so:



      %semisudo localhost=/path/to/command
      %semisudo localhost=/path/to/another/command


      And then add the user to that group and kick them out of admin/sudo.






      share|improve this answer

























      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then

        – user1726453
        Dec 19 '14 at 12:36











      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .

        – user1726453
        Dec 19 '14 at 12:46






      • 1





        @user1726453 and anyone having the same concern, see this answer on logging possibility after sudo su: unix.stackexchange.com/a/109836/30230

        – PF4Public
        Jun 3 '16 at 18:18













      8












      8








      8







      With respect, if you get what you ask for and somebody can run sudo <anything but su>, they can:



      • Run sudo bash

      • Run sudo -i

      • Create a script that does something similar (including directly running su).

      • Just edit the configuration with sudo visudo

      The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.



      If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo) and add each command to sudoers, like so:



      %semisudo localhost=/path/to/command
      %semisudo localhost=/path/to/another/command


      And then add the user to that group and kick them out of admin/sudo.






      share|improve this answer















      With respect, if you get what you ask for and somebody can run sudo <anything but su>, they can:



      • Run sudo bash

      • Run sudo -i

      • Create a script that does something similar (including directly running su).

      • Just edit the configuration with sudo visudo

      The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.



      If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo) and add each command to sudoers, like so:



      %semisudo localhost=/path/to/command
      %semisudo localhost=/path/to/another/command


      And then add the user to that group and kick them out of admin/sudo.







      share|improve this answer














      share|improve this answer



      share|improve this answer








      edited Jun 4 '16 at 8:28

























      answered Dec 19 '14 at 12:23









      OliOli

      224k90567768




      224k90567768












      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then

        – user1726453
        Dec 19 '14 at 12:36











      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .

        – user1726453
        Dec 19 '14 at 12:46






      • 1





        @user1726453 and anyone having the same concern, see this answer on logging possibility after sudo su: unix.stackexchange.com/a/109836/30230

        – PF4Public
        Jun 3 '16 at 18:18

















      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then

        – user1726453
        Dec 19 '14 at 12:36











      • Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .

        – user1726453
        Dec 19 '14 at 12:46






      • 1





        @user1726453 and anyone having the same concern, see this answer on logging possibility after sudo su: unix.stackexchange.com/a/109836/30230

        – PF4Public
        Jun 3 '16 at 18:18
















      Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then

      – user1726453
      Dec 19 '14 at 12:36





      Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then

      – user1726453
      Dec 19 '14 at 12:36













      Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .

      – user1726453
      Dec 19 '14 at 12:46





      Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .

      – user1726453
      Dec 19 '14 at 12:46




      1




      1





      @user1726453 and anyone having the same concern, see this answer on logging possibility after sudo su: unix.stackexchange.com/a/109836/30230

      – PF4Public
      Jun 3 '16 at 18:18





      @user1726453 and anyone having the same concern, see this answer on logging possibility after sudo su: unix.stackexchange.com/a/109836/30230

      – PF4Public
      Jun 3 '16 at 18:18













      0














      Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.





      share



























        0














        Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.





        share

























          0












          0








          0







          Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.





          share













          Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.






          share











          share


          share










          answered 9 mins ago









          Ben Z.Ben Z.

          613




          613





















              -1














              I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .



              #root ALL=(ALL:ALL) ALL


              It is working for me . Thanks all for your help .






              share|improve this answer





























                -1














                I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .



                #root ALL=(ALL:ALL) ALL


                It is working for me . Thanks all for your help .






                share|improve this answer



























                  -1












                  -1








                  -1







                  I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .



                  #root ALL=(ALL:ALL) ALL


                  It is working for me . Thanks all for your help .






                  share|improve this answer















                  I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .



                  #root ALL=(ALL:ALL) ALL


                  It is working for me . Thanks all for your help .







                  share|improve this answer














                  share|improve this answer



                  share|improve this answer








                  edited Dec 19 '14 at 13:33









                  muru

                  1




                  1










                  answered Dec 19 '14 at 13:19









                  user1726453user1726453

                  21112




                  21112



























                      draft saved

                      draft discarded
















































                      Thanks for contributing an answer to Ask Ubuntu!


                      • Please be sure to answer the question. Provide details and share your research!

                      But avoid


                      • Asking for help, clarification, or responding to other answers.

                      • Making statements based on opinion; back them up with references or personal experience.

                      To learn more, see our tips on writing great answers.




                      draft saved


                      draft discarded














                      StackExchange.ready(
                      function ()
                      StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f563275%2fdisabling-sudo-su-in-ubuntu-14-04%23new-answer', 'question_page');

                      );

                      Post as a guest















                      Required, but never shown





















































                      Required, but never shown














                      Required, but never shown












                      Required, but never shown







                      Required, but never shown

































                      Required, but never shown














                      Required, but never shown












                      Required, but never shown







                      Required, but never shown







                      Popular posts from this blog

                      Möglingen Índice Localización Historia Demografía Referencias Enlaces externos Menú de navegación48°53′18″N 9°07′45″E / 48.888333333333, 9.129166666666748°53′18″N 9°07′45″E / 48.888333333333, 9.1291666666667Sitio web oficial Mapa de Möglingen«Gemeinden in Deutschland nach Fläche, Bevölkerung und Postleitzahl am 30.09.2016»Möglingen

                      Virtualbox - Configuration error: Querying “UUID” failed (VERR_CFGM_VALUE_NOT_FOUND)“VERR_SUPLIB_WORLD_WRITABLE” error when trying to installing OS in virtualboxVirtual Box Kernel errorFailed to open a seesion for the virtual machineFailed to open a session for the virtual machineUbuntu 14.04 LTS Virtualbox errorcan't use VM VirtualBoxusing virtualboxI can't run Linux-64 Bit on VirtualBoxUnable to insert the virtual optical disk (VBoxguestaddition) in virtual machine for ubuntu server in win 10VirtuaBox in Ubuntu 18.04 Issues with Win10.ISO Installation

                      Torre de la Isleta Índice Véase también Referencias Bibliografía Enlaces externos Menú de navegación38°25′58″N 0°23′02″O / 38.43277778, -0.3838888938°25′58″N 0°23′02″O / 38.43277778, -0.38388889Torre de la Illeta de l’Horta o Torre Saleta. Base de datos de bienes inmuebles. Patrimonio Cultural. Secretaría de Estado de CulturaFicha BIC Torre de la Illeta de l’Horta. Dirección General de Patrimonio Cultural. Generalitat ValencianaLugares de interés. Ayuntamiento del CampelloTorre de la Isleta en CastillosNet.org