In FreeIPA you can create users and restrict on which hosts the user can login 
to. This is all great and works fine.

If a user1 is logged in to a system. Knows the password of user2 and issues the 
command "su" to be that user2 on that same system. This is not allowed because 
the user2 does not have HBAC rules for that system. This is as expected.

But if the user root tries the "su" command to be user2 is works despite the 
fact that user2 has no HBAC rule for that system.

Why does this works? Is there a way to prevent this? Or is this something in 
"su" that it works like the way it does?

Best regards,


This message (including any attachments) may contain information that is 
privileged or confidential. If you are not the intended recipient, please 
notify the sender and delete this email immediately from your systems and 
destroy all copies of it. You may not, directly or indirectly, use, disclose, 
distribute, print or copy this email or any part of it if you are not the 
intended recipient
Manage your subscription for the Freeipa-users mailing list:
Go To http://freeipa.org for more info on the project

Reply via email to