In Linux system administration, the su (Substitute User) command is a powerful tool. By typing su - and entering the master root password, any standard user on the system can instantly elevate their privileges and become the omnipotent “root” account.
While you should closely guard the root password, relying solely on password secrecy is a terrible security practice. If a low-level employee or a compromised web application account (like www-data) manages to guess or steal the root password, they can type su - and instantly destroy the server. To implement a “Zero Trust” architecture, you must explicitly configure the operating system to permanently block specific users from even attempting to use the su command, regardless of whether they know the password or not.
This is achieved by modifying the PAM (Pluggable Authentication Modules) configuration to restrict su access strictly to the wheel group.
Step 1: Enable the Wheel Group Restriction in PAM
The “wheel” group is a traditional Unix security group specifically designed to control who is allowed to become root. By default on many modern distributions (like Ubuntu), this restriction is turned off.
- Log into your server and elevate to root (since you are about to lock others out).
- Open the PAM configuration file for the
sucommand using a text editor like nano:sudo nano /etc/pam.d/su - Scroll down through the file until you find the following line. (It is usually commented out with a
#symbol):# auth required pam_wheel.so use_uid - Delete the
#symbol to activate the rule. The line should now look exactly like this:auth required pam_wheel.so use_uid - Save the file (Ctrl+O, Enter) and exit (Ctrl+X).
Warning: The exact millisecond you save this file, every single user on the entire server is instantly banned from using the su command—including your own administrative account (unless you are already in the wheel group).
Step 2: Add Trusted Administrators to the Wheel Group
Before you log out of your current root session, you must add your own personal user account to the wheel group so you don’t lock yourself out forever.
- Run the following command to add your user (e.g.,
john) to the group:usermod -aG wheel john(Note: On Ubuntu/Debian, the
wheelgroup might not exist by default; the equivalent is thesudogroup. If you get an error that ‘wheel’ doesn’t exist, create it first withgroupadd wheel, or use thesudogroup instead if your PAM file specifies it).
Step 3: Test the Security Blockade
Now, let’s test the restriction on an untrusted user (e.g., an intern named mark who is not in the wheel group).
- Switch to Mark’s account:
su - mark - As Mark, attempt to become root:
su - - The system will prompt for the root password. Even if Mark types the correct, perfectly accurate root password, the PAM module will silently intercept the request, realize Mark is not in the wheel group, and instantly reject the attempt with an Authentication failure message.
By enforcing this PAM rule, you have created a physical firewall around the root account. A hacker cannot brute-force the su password from a compromised service account because the operating system simply refuses to let them try.