Re: Problem with newer versions

On Fri, 15 Apr 2005 17:13:13 +0200 (CEST), Martin K=F6hling
<[email protected]> wrote:

> On Mon, 21 Mar 2005, Markus Ottenbacher wrote:
>=20
> > /usr/sbin/fou4s: line 1425: su: command not found
> >=20
> > (which is correct, since we don't have su on our machines. It would
> > open gaping security holes in combination with sudo rights some
> > users have).
>=20
> Wouldn't simply clearing the SUID bit on /bin/su make it quite
> harmless, while still being usable by root?

Sorry for the late answer...

Well, no.=20

Being usable by root _is_ (was) the problem: root is allowed (and has to
be, otherwise usage in a script as in fou4s wouldn't work) to change to
a different user without entering a password.

In our case, we want to allow ordinary users to run commands as root on
their (self-administered) box with sudo, while not allowing them to su
to another user.

Clearing the SUID-Bit doesn't help here, because IMHO sudo - while still
better than giving the root-PW away - cannot be configured to be really
safe _and_ usable at the same time.

Just for the record (if anyone should encounter a similar problem):
adjusting the PAM-settings for su helped. See

http://www.phptr.com/articles/article.asp?p=3D165226&seqNum=3D11

thanks
	markus

BTW: fou4s works well on our 9.3 boxes (2 so far, more to come). :-)

--