mjhjmtu

I need to allow user martin to switch to user martin-test without password

su - martin-test

I think this can be configured in /etc/pam.d/su. There are already some lines in that file which can be uncommented. However, I don't like the idea of adding user martin to group wheel. I don't want to give martin any more privileges than to be able to switch to martin-test. I also do not want to use sudo.

What would be the best way to do it, while keeping the privileges of user martin minimal?

Add the following lines right below the pam_rootok.so line in your /etc/pam.d/su:

auth [success=ignore default=1] pam_succeed_if.so user = martin-test
auth sufficient pam_succeed_if.so use_uid user = martin

These lines perform checks using the pam_succeed_if.so module. See also the Linux-PAM configuration file syntax to learn more about the auth lines.

• The first line checks whether the target user is martin-test. If it is, nothing happens (success=ignore) and we continue on the next line to check the current user. If it is not, the next line will be skipped (default=1) and we continue on subsequent lines with the usual authentication steps.


• The second line checks whether the current user is martin. If it is, the system considers the authentication process as successful and returns (sufficient). If it is not, nothing happens and we continue on subsequent lines with the usual authentication steps.

You can also restrict su to a group, here the group allowedpeople can su without a password:

auth sufficient pam_succeed_if.so use_uid user ingroup allowedpeople

If you don't want to change groups or use sudo, use a pam module called pam_exec to execute external scripts in a pam stage.

Add a line in your /etc/pam.d/su after the pam_rootok.so line:

auth sufficient pam_exec.so quiet /path/to/script

/path/to/script has the permissions 755 (rwxr-xr-x) and the following content:

#!/bin/bash
if [ "$PAM_TYPE" == "auth" ] && 
[ "$PAM_USER" == "martin-test" ] && 
[ "$PAM_RUSER" == "martin" ]; then
 exit 0
else
 exit 1
fi

So this script exists with success if su:

• is called in context of authentication,


• the calling user is martin and


• the user to authenticate is martin-test.

See:

martin@host:~$ su - martin-test
martin-test@host:~$ exit
martin@host:~$ su - otheruser
Password: ****
otheruser@host:~$ 

If you don't have access to the root account, but have the password of the user you want to use to run a command, you can do the following.

• This will ask you the toto's password : su - toto -c whoami
  


• This will not : ssh toto@localhost whoami
  

Just install your public key in authorized_keys of toto

Hope this can help ...

My simple solution is:

sudo login -f martin-test

If you want to avoid sudo at all cost, I think it should be possible to put this in a script:

1. owned by root and with root privileges (using the setuid flag)


2. executable by everybody, also without any sudo.

However, I can't figure out the chown root and chmod +s ToTest.sh bits, to make this actually work:

#!/usr/bin/env bash
echo howdy, I am $(whoami)
sudo login -f martin-test

I still runs as my normal user, as the echo tells me. And it still requires sudo password. If it was running as root, one could do away with the sudo in the last line...