How to Restrict the su Command to a Specific Group in Linux

The Security Risk of the su Command

In Linux, the su (substitute user) command allows any user to switch to another account, provided they know the password. If a user types su -, they can attempt to switch directly to the all-powerful root account. While they still need to guess the root password, leaving this command accessible to everyone exposes your server to brute-force attacks and privilege escalation exploits.

A standard security best practice in enterprise Linux environments is to restrict the execution of the su command so that only users belonging to a highly trusted group (traditionally the wheel group) are even allowed to attempt it. If an unauthorized user tries to run su, they will be instantly rejected before they can even type a password.

Step 1: Verify the Wheel Group Exists

First, ensure that the wheel group exists on your system. Open your terminal and run:

grep wheel /etc/group

If it exists, you will see output like wheel:x:27:. If it does not exist (which is rare), you can create it using sudo groupadd wheel.

Step 2: Add Trusted Users to the Group

Next, add the specific users you trust into this group. Replace jdoe with the actual username of your trusted administrator:

sudo usermod -aG wheel jdoe

You can verify the user was added successfully by running groups jdoe.

Step 3: Configure Pluggable Authentication Modules (PAM)

Linux uses PAM to handle authentication policies. We need to edit the specific PAM configuration file that governs the su command.

sudo nano /etc/pam.d/su

Scroll down through the file until you locate the following line. It is usually commented out (disabled) with a hashtag (#) at the beginning:

# auth required pam_wheel.so use_uid

Remove the hashtag to uncomment the line, so it looks exactly like this:

auth required pam_wheel.so use_uid

Save and close the file (Ctrl+O, Enter, Ctrl+X in Nano).

Step 4: Verify the Restriction is Working

The changes take effect immediately; no service restarts are required. To test the security control, log into the server as a standard user who is not a member of the wheel group.

Attempt to switch to the root user:

su -

Instead of being prompted for a password, the system will immediately terminate the command and output a su: Permission denied error. The server is now significantly more secure against lateral privilege escalation.