RHEL 9 must restrict the use of the "su" command.
An XCCDF Rule
Description
<VulnDiscussion>The "su" program allows to run commands with a substitute user and group ID. It is commonly used to run commands as the root user. Limiting access to such commands is considered a good security practice. Satisfies: SRG-OS-000373-GPOS-00156, SRG-OS-000312-GPOS-00123</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-258088r926251_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Configure RHEL 9 to require users to be in the "wheel" group to run "su" command.
In file "/etc/pam.d/su", uncomment the following line:
"#auth required pam_wheel.so use_uid"