search

ghoneycutt / puppet-module-pam

Puppet module to manage PAM
Other
18 stars 80 forks source link

Restrict Root user from switching users without password prompt #222

Closed jamboNum5 closed 4 years ago

jamboNum5 commented 4 years ago

In Ubuntu, pam_rootok.so can be removed/commented to force a root user has a password prompt if they run su username. I don't know whether this same configuration can be fulfilled in this puppet module.

/etc/pam.d/su
# auth       sufficient pam_rootok.so

I know this isn't exactly infallible config, but it does at least do something to slow down people with root access if they are doing malicious actions.

Thanks

ghoneycutt commented 4 years ago

You can accomplish this using pam::service. Check out https://github.com/ghoneycutt/puppet-module-pam/blob/master/manifests/service.pp