Rocky 9.2 unable to su

Rocky Linux General
1

I have a fresh install of Rocky 9 DVD as a “Workstation with GUI” and I have selected the CIS RHEL 9 Workstation Level 1 Benchmark security profile and I have SELinux in enforcing mode. I am running into a problem where non-privileged user is unable to execute an “su” to become root or to another user even with a correct password. When an “su” is executed an error message is returned as:

su
Password:
su: Permission denied

I have never encountered this situation before and I cannot find any information in the log files to indicate the source of the problem. When I execute (as user1)

su user 2

the /var/log/messages file shows this entry:

*Jul 13 13:21:12 user1 su[54604]: FAILED SU (to user2) user1 on pts/1*

I see no entries in /var/log/secure to indicate a password failure. There is an entry in /var/log/audit/audit.log as:

type=USER_AUTH msg=audit(1689269269.922:621): *pid=55167 uid=1000 auid=1000 ses=15 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:authentication grantors=? acct="user2" exe="/usr/bin/su" hostname=? addr=? terminal=/dev/pts/1 res=failed'UID="user1" AUID="user2"*

Truthfully I have no idea as to how to interpret this to get a clue as to the reason for the failure. I have tried disabling SELinux enforcement but that did not resolve the issue. I have verified that the passwords are correct by logging in to the accounts via ssh with no issues. If I make the non-privileged user a member of the wheel group I can sudo or su but I do not wish to do this. Any suggestions as to what may be wrong would be appreciated!

2

I would say the thing you did wrong was select the CIS security profile. You should have just left it as it was by not selecting it.

Do a new install, without selecting the security profile, and you will see that su works.

Selecting security profiles, puts restrictions on what you can and cannot do.

3

Thank you for your reply but I have other Rocky 9.2 installs with the same security profile without this issue manifesting. And I have valid reasons why it is necessary to select that security profile.

4

As far as I know, the CIS profile makes it so that a user must be part of the wheel group to perform su. You can verify this in /etc/pam.d/su.

5

Thank you so much for the helpful post! I also discovered this about 15 minutes ago after digging through the CIS profile document for Rocky 9 which I downloaded and dug into. There is suggested alternative on page 617 of that document which involves creating a special group which would allow members to execute su. I was just about to post about this but you beat me to it. I spent a half day puzzling over this but learned quite a lot. Thanks again for the great answer!

1 Like
6

There’s a sudo or sudoers group.

I don’t know how I did it but I managed to kick myself out of that group at some point.

1 Like