unix - disable "su" for ssh'ers

Question

I'd like to disable getting root at all for users who ssh in - including "sudo su" cause that's pretty much the same thing... Can this be done? Assume that I'M not ssh'ing in, and have physical access to the machine, but want to prevent other users from gaining root without physical access.

Answer 1

I can't think to a generic way of having the same user able to do sudo in a graphical terminal (which is a virtual tty) and not on a ssh connection --- that in the end is just another kind of virtual tty.

What I can think as an approximate solution is:

1. have trusted users that can do sudo(1), call them alpha and beta

2. have users that can't do sudo(1), call them aleph y bet

Now, forbid ssh login to alpha y beta using the DenyUsers directive in /etc/ssh/sshd.conf:

DenyUsers alpha beta 

If you want that the user alpha y aleph can share files, you can make them the same group or members of an additional group and adjust the file permissions accordingly.

---

Footnotes:

(1) Just a reminder: a user can do sudo if it's a member of the group sudo or adm (depending on Ubuntu version). To remove the ability for an user to do sudo:

gpasswd -d user sudo 
gpasswd -d user adm 

and to enable it:

gpasswd -a user sudo 
gpasswd -a user adm 

(one or the other --- check with groups which is the correct group in your system).

Answer 2

If you don't require a fool-proof solution, you can make a wrapper for sudo that checks to see if you're logged in over SSH before running the real sudo. Just create a /usr/local/bin/sudo script, mark it executable (sudo chmod +x /usr/local/bin/sudo), and add these contents:

#!/bin/sh

if [ "$SSH_CLIENT" != "" ]; then
    echo "remote sudo access is disabled" 1>&2
    exit 1
fi

/usr/bin/sudo "$@"

Flaws:

1. while it works for sudo, it can be bypassed by calling /usr/bin/sudo directly
2. it relies on the contents of the SSH_CLIENT environment variable, so a user can bypass the restriction by clearing this environment variable

It's possible there's ways to address these issues, but if you just need something to stop your "typical" user then this should work.