How to Disable ‘su’ Access for Sudo Users

The su command is a special Linux command that allows you to run a command as another user and group. It also allows you to switch to the root account (if run without any arguments) or another specified user account.

All users by default are allowed to access the su command. But as a system administrator, you can disable su access for a user or group of users, using the sudoers file as explained below.

The sudoers file drives the sudo security policy plugin which determines a user’s sudo privileges. The sudo command allows users to run programs with the security privileges of another user (by default, as the root user).

To switch to another user account, a user can run the su command from their current login session as shown. In this example, the user aaronk is switching to a testuser account. The user aaronk will be prompted to enter the password for the testuser account:

$ su testuser
 
Switch to Different User

To switch to the root account, a user must have the root password or have privileges to invoke the sudo command. In other words, the user must exist in the sudoers file. In this example, the user aaronk (a sudo user) is switching to the root account.

After invoking sudo, the user aaronk is prompted to enter his or her password, if it’s valid, the user is granted access to an interactive shell as root:

$ sudo su
 
Switch to Root User

Disable su Access for a Sudo User

To disable su access for a sudo user for example the aaronk user above, first, back up the original sudoers file located at /etc/sudoers as follows:

$ sudo cp /etc/sudoers /etc/sudoers.bak
 

Then open the sudoers file using the following command. Note that it’s not recommended to edit the sudoers file by hand, always use the visudo command:

 
 $ sudo visudo
 

Under the section of command aliases, create the following alias:

Cmnd_Alias DISABLE_SU = /bin/su
 

Then add the following line at the end of the file, replace the username aaronk with the user you wish to disable su access for:

aaronk ALL=(ALL) NOPASSWD: ALL, !DISABLE_SU
 

Save the file and close it.

Then test to verify that setup is working as follows. The system should return an error message like this: “Sorry, user aaronk is not allowed to execute ‘/bin/su’ as root on tecmint.”.

$ sudo su
 
Disable Su Access to Sudo User

Disable su Access for a Group of Sudo Users

You can also disable su access for a group of sudo users. For example to disable su access for all users in the group admin, modify the line:

%admin ALL=(ALL) ALL
 

to this:

%admin ALL=(ALL) ALL, !DISABLE_SU
 

Save the file and close it.

To add a user to the admin group, run the usermod command (replace username with the actual user):

$ sudo usermod -aG admin username
 

For more information about the su, sudo and sudoers, check their man pages:

$ man su
 $ man sudo
 $ man sudoers
 
If you liked this article, then do subscribe to email alerts for Linux tutorials. If you have any questions or doubts? do ask for help in the comments section.

If You Appreciate What We Do Here On TecMint, You Should Consider:

TecMint is the fastest growing and most trusted community site for any kind of Linux Articles, Guides and Books on the web. Millions of people visit TecMint! to search or browse the thousands of published articles available FREELY to all.

If you like what you are reading, please consider buying us a coffee ( or 2 ) as a token of appreciation.

We are thankful for your never ending support.

2 thoughts on “How to Disable ‘su’ Access for Sudo Users”

  1. In the last code block, you have “sodoers” misspelled as “sudeors“…

    $ man su $ man sudo $ man sudeors 
    Reply

Got something to say? Join the discussion. Cancel reply