How can I block a user not to use "sudo su -" command ? Because that will give him root access anyway. I want to limit him to read only permission for all files apart from what ever I give write access.

  • 4
    Standard users won't have permission unless you add permission in sudoers file.
    – vembutech
    Nov 28 '16 at 11:04

If you want a user to have sudo permission for other commands, but not to be able to log in as root, you need to edit the visudo file and specify the access you want the user to have.

sudo visudo

Then inside that file you would define the user and give permissions based on what you want that user to be able to do, for example

test    ALL=(ALL:`/home/test/) /home/test/, /usr/bin/vi, !/usr/bin/su

The above states that user test is allowed to access their home directory, run vim with sudo (as root) but nothing else. I am also explicitly telling the sudoers file to not allow the user to run su.

You should take a moment and read the sudoers manual, it explains everything.

  • "for all you haters out there, I do not have the reputation to comment yet" Haters? We have rules for a reason, you only need 50 rep to comment, earn it. Do you really think insulting the community will get you votes?
    – Mark Kirby
    Nov 28 '16 at 12:56
  • !/usr/bin/su entry in visudo answered my query. yes, I wanted to block the user from accessing root. Thanks for your help. Will go through Sudoers manual to check further.
    – user624441
    Dec 4 '16 at 9:25
  • Can you mark it as correct? Dec 5 '16 at 2:29
  • 1
    Using '!' on a command spec is a VERY risky thing, since it's so easy to work around. I'd recommend a classic 'mostly closed' setup, and never allowing anything in the list of tools that would also allow privilege escalation. (vi is in that list. Consider something newer) Dec 18 '18 at 17:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.