Disabling sudo su in ubuntu 14.04 Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) sudo, su problemsWhy is sudo -s better than sudo su?What are the differences between “su”, “sudo -s”, “sudo -i”, “sudo su”?I can't do “sudo”sudo su doesn't change users for mysqlAccessing sudo from a non-administrator profileUbuntu sudo su and server su clarificationRe-disabling the root accountSudo and su simultaneously?sudo -i and sudo su - explained
When is phishing education going too far?
Can I throw a longsword at someone?
What items from the Roman-age tech-level could be used to deter all creatures from entering a small area?
Stop battery usage [Ubuntu 18]
Why does tar appear to skip file contents when output file is /dev/null?
How does modal jazz use chord progressions?
Replacing HDD with SSD; what about non-APFS/APFS?
Can a zero nonce be safely used with AES-GCM if the key is random and never used again?
How to market an anarchic city as a tourism spot to people living in civilized areas?
Is it possible to ask for a hotel room without minibar/extra services?
Problem when applying foreach loop
Complexity of many constant time steps with occasional logarithmic steps
How do I automatically answer y in bash script?
Autumning in love
Geometric mean and geometric standard deviation
If I can make up priors, why can't I make up posteriors?
How to say that you spent the night with someone, you were only sleeping and nothing else?
Slither Like a Snake
Determine whether f is a function, an injection, a surjection
Area of a 2D convex hull
What's the point in a preamp?
Blender game recording at the wrong time
Estimated State payment too big --> money back; + 2018 Tax Reform
How do I keep my slimes from escaping their pens?
Disabling sudo su in ubuntu 14.04
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) sudo, su problemsWhy is sudo -s better than sudo su?What are the differences between “su”, “sudo -s”, “sudo -i”, “sudo su”?I can't do “sudo”sudo su doesn't change users for mysqlAccessing sudo from a non-administrator profileUbuntu sudo su and server su clarificationRe-disabling the root accountSudo and su simultaneously?sudo -i and sudo su - explained
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty margin-bottom:0;
I need to accomplish following things .
Disable ubuntu user
Disable sudo su for all user .
Each user should able to execute sudo
I have modified my sudoer file as below
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
Still I can access sudo using the command
# sudo sudo su
How to disable this . Any help is highly apprciable . Thanks in advance .
su
add a comment |
I need to accomplish following things .
Disable ubuntu user
Disable sudo su for all user .
Each user should able to execute sudo
I have modified my sudoer file as below
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
Still I can access sudo using the command
# sudo sudo su
How to disable this . Any help is highly apprciable . Thanks in advance .
su
Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.
– vembutech
Dec 19 '14 at 12:09
It did not work for me .
– user1726453
Dec 19 '14 at 12:54
add a comment |
I need to accomplish following things .
Disable ubuntu user
Disable sudo su for all user .
Each user should able to execute sudo
I have modified my sudoer file as below
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
Still I can access sudo using the command
# sudo sudo su
How to disable this . Any help is highly apprciable . Thanks in advance .
su
I need to accomplish following things .
Disable ubuntu user
Disable sudo su for all user .
Each user should able to execute sudo
I have modified my sudoer file as below
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults env_reset
Defaults mail_badpass
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Cmnd_Alias NSHELLS = /bin/sh,/bin/bash
Cmnd_Alias NSU = /bin/su
# Host alias specification
# User alias specification
# Cmnd alias specification
# User privilege specification
root ALL=(ALL:ALL) ALL
# Members of the admin group may gain root privileges
%admin ALL=(ALL) ALL
**%sysadmins ALL=(ALL) NOPASSWD:ALL ,!NSHELLS, !NSU**
# Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL
# See sudoers(5) for more information on "#include" directives:
Still I can access sudo using the command
# sudo sudo su
How to disable this . Any help is highly apprciable . Thanks in advance .
su
su
edited Dec 19 '14 at 13:34
muru
1
1
asked Dec 19 '14 at 11:26
user1726453user1726453
21112
21112
Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.
– vembutech
Dec 19 '14 at 12:09
It did not work for me .
– user1726453
Dec 19 '14 at 12:54
add a comment |
Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.
– vembutech
Dec 19 '14 at 12:09
It did not work for me .
– user1726453
Dec 19 '14 at 12:54
Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.
– vembutech
Dec 19 '14 at 12:09
Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.
– vembutech
Dec 19 '14 at 12:09
It did not work for me .
– user1726453
Dec 19 '14 at 12:54
It did not work for me .
– user1726453
Dec 19 '14 at 12:54
add a comment |
3 Answers
3
active
oldest
votes
With respect, if you get what you ask for and somebody can run sudo <anything but su>
, they can:
- Run
sudo bash
- Run
sudo -i
- Create a script that does something similar (including directly running
su
). - Just edit the configuration with
sudo visudo
The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.
If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo
) and add each command to sudoers
, like so:
%semisudo localhost=/path/to/command
%semisudo localhost=/path/to/another/command
And then add the user to that group and kick them out of admin
/sudo
.
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then
– user1726453
Dec 19 '14 at 12:36
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .
– user1726453
Dec 19 '14 at 12:46
1
@user1726453 and anyone having the same concern, see this answer on logging possibility aftersudo su
: unix.stackexchange.com/a/109836/30230
– PF4Public
Jun 3 '16 at 18:18
add a comment |
Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.
add a comment |
I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .
#root ALL=(ALL:ALL) ALL
It is working for me . Thanks all for your help .
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "89"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f563275%2fdisabling-sudo-su-in-ubuntu-14-04%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
With respect, if you get what you ask for and somebody can run sudo <anything but su>
, they can:
- Run
sudo bash
- Run
sudo -i
- Create a script that does something similar (including directly running
su
). - Just edit the configuration with
sudo visudo
The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.
If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo
) and add each command to sudoers
, like so:
%semisudo localhost=/path/to/command
%semisudo localhost=/path/to/another/command
And then add the user to that group and kick them out of admin
/sudo
.
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then
– user1726453
Dec 19 '14 at 12:36
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .
– user1726453
Dec 19 '14 at 12:46
1
@user1726453 and anyone having the same concern, see this answer on logging possibility aftersudo su
: unix.stackexchange.com/a/109836/30230
– PF4Public
Jun 3 '16 at 18:18
add a comment |
With respect, if you get what you ask for and somebody can run sudo <anything but su>
, they can:
- Run
sudo bash
- Run
sudo -i
- Create a script that does something similar (including directly running
su
). - Just edit the configuration with
sudo visudo
The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.
If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo
) and add each command to sudoers
, like so:
%semisudo localhost=/path/to/command
%semisudo localhost=/path/to/another/command
And then add the user to that group and kick them out of admin
/sudo
.
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then
– user1726453
Dec 19 '14 at 12:36
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .
– user1726453
Dec 19 '14 at 12:46
1
@user1726453 and anyone having the same concern, see this answer on logging possibility aftersudo su
: unix.stackexchange.com/a/109836/30230
– PF4Public
Jun 3 '16 at 18:18
add a comment |
With respect, if you get what you ask for and somebody can run sudo <anything but su>
, they can:
- Run
sudo bash
- Run
sudo -i
- Create a script that does something similar (including directly running
su
). - Just edit the configuration with
sudo visudo
The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.
If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo
) and add each command to sudoers
, like so:
%semisudo localhost=/path/to/command
%semisudo localhost=/path/to/another/command
And then add the user to that group and kick them out of admin
/sudo
.
With respect, if you get what you ask for and somebody can run sudo <anything but su>
, they can:
- Run
sudo bash
- Run
sudo -i
- Create a script that does something similar (including directly running
su
). - Just edit the configuration with
sudo visudo
The point I'm trying to make is that if you allow people to run anything (or even nearly anything), they are as good as root. There are incalculable numbers of ways they could circumvent you.
If you only want them to be able to run a finite number of commands as root, create a new group (eg semisudo
) and add each command to sudoers
, like so:
%semisudo localhost=/path/to/command
%semisudo localhost=/path/to/another/command
And then add the user to that group and kick them out of admin
/sudo
.
edited Jun 4 '16 at 8:28
answered Dec 19 '14 at 12:23
Oli♦Oli
224k90567768
224k90567768
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then
– user1726453
Dec 19 '14 at 12:36
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .
– user1726453
Dec 19 '14 at 12:46
1
@user1726453 and anyone having the same concern, see this answer on logging possibility aftersudo su
: unix.stackexchange.com/a/109836/30230
– PF4Public
Jun 3 '16 at 18:18
add a comment |
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then
– user1726453
Dec 19 '14 at 12:36
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .
– user1726453
Dec 19 '14 at 12:46
1
@user1726453 and anyone having the same concern, see this answer on logging possibility aftersudo su
: unix.stackexchange.com/a/109836/30230
– PF4Public
Jun 3 '16 at 18:18
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then
– user1726453
Dec 19 '14 at 12:36
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Here the motto is to see the changes made by the sysadmin users on a server . if sudo su will work , then
– user1726453
Dec 19 '14 at 12:36
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .
– user1726453
Dec 19 '14 at 12:46
Thanks for quick update and information .I understand the risk of allowing everything with sudo .Difficult for us to add finite command for systemadmins who access the server daily basis .Here the motto is to see the changes made by the each sysadmin users on a server . if sudo su will work , then difficult to monitor their activities as they can run command after hitting sudo su .Everything will logged as root rather than the user name .
– user1726453
Dec 19 '14 at 12:46
1
1
@user1726453 and anyone having the same concern, see this answer on logging possibility after
sudo su
: unix.stackexchange.com/a/109836/30230– PF4Public
Jun 3 '16 at 18:18
@user1726453 and anyone having the same concern, see this answer on logging possibility after
sudo su
: unix.stackexchange.com/a/109836/30230– PF4Public
Jun 3 '16 at 18:18
add a comment |
Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.
add a comment |
Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.
add a comment |
Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.
Are you sure this is the solution? I tried to use this to disable sudo su - on my Rasbian as user pi, I still got in as root without even being asked for password for pi. Quite dangerous it seems.
answered 9 mins ago
Ben Z.Ben Z.
613
613
add a comment |
add a comment |
I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .
#root ALL=(ALL:ALL) ALL
It is working for me . Thanks all for your help .
add a comment |
I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .
#root ALL=(ALL:ALL) ALL
It is working for me . Thanks all for your help .
add a comment |
I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .
#root ALL=(ALL:ALL) ALL
It is working for me . Thanks all for your help .
I got work around to disable sudo sudo su . Just need to comment below line in sudoer file .
#root ALL=(ALL:ALL) ALL
It is working for me . Thanks all for your help .
edited Dec 19 '14 at 13:33
muru
1
1
answered Dec 19 '14 at 13:19
user1726453user1726453
21112
21112
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f563275%2fdisabling-sudo-su-in-ubuntu-14-04%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Try with the command hope it will simply help you to disable sudosu for the user sudo passwd -dl root.
– vembutech
Dec 19 '14 at 12:09
It did not work for me .
– user1726453
Dec 19 '14 at 12:54