Vrftjkry

I am a system auditor with very limited knowledge of Linux OS. I am currently auditing a RHEL 7 server and found out that a group of users are authenticating through LDAP and using 'su' through PAM. I'd like to know the interpretation of the following file content and where can I view their access logs.

etc/pam.d/su



#%PAM-1.0

auth        sufficient  pam_rootok.so

auth           [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup bdbadmin

auth           required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-bdbadmin-access

auth           required pam_wheel.so use_uid group=bdbadmin

auth           [success=2 default=ignore] pam_succeed_if.so use_uid user notingroup wheel

auth           required pam_listfile.so item=user sense=allow onerr=fail file=/etc/security/su-wheel-access

auth           required pam_wheel.so use_uid group=wheel



"# Uncomment the following line to implicitly trust users in the "wheel" group.

"#auth      sufficient  pam_wheel.so trust use_uid

"# Uncomment the following line to require a user to be in the "wheel" group.

"#auth      required    pam_wheel.so use_uid



auth        substack    system-auth

auth        include     postlogin

account     sufficient  pam_succeed_if.so uid = 0 use_uid quiet

account     include     system-auth

password    include     system-auth

session     include     system-auth

session     include     postlogin

session     optional    pam_xauth.so

As per my understanding, the users in group bdbadmin are allowed to su access but I don't know where to look for a sudoers list or their access logs.

Thanks in advance.

Welcome to StackExchange, and in particular to SuperUser.

1. The access log is located in /var/log/auth.log, and of course it can only be viewed by root.



2. 
   

   The command to list all members of a given group is members, if it is installed in your machine (it is not by default),

   
   
   

   members sudo
   
   

   
   
   

   or you can directly parse the /etc/group file which contains the relevant information,

   
   
   

   grep /etc/group sudo
   
   

   
   
   

   and you can double-check that with

   
   
   

   group UserName
   
   

   
   

to see all groups UserName belongs to.

3. As for PAM and the file su, you should know that by default PAM uses a configuration file located in /etc/pam.conf unless the directory /etc/pam.d/ is not empty (your case), in which case the directory content has higher precedence. The syntax of the entries is best learned by referencing the manual here; this Web page first discusses the syntax of the /etc/pam.conf file, then that of the /etc/pam.d/ directory, which is marginally different (and now you see why I had to mention the difference above).

If you have a specific question about the content of the ruleset in su above, which after reading the Manual appears quite transparent to me, I will be happy to answer it, if I can.