su to root possible without being in wheel

[lubos]

Hello,

my build is "FreeNAS-8.0.3-RELEASE-p1-x86 (9591)". Any user I create is able to su to root without being added to wheel group. Is this anyhow on purpose? Or is it corrected in later versions?

Thanks in advance,

Lubos

 

[peterh]

Quoting the manpage of "su" :

PAM is used to set the policy su(1) will use. In particular, by default
only users in the ``wheel'' group can switch to UID 0 (``root''). This
group requirement may be changed by modifying the ``pam_group'' section
of /etc/pam.d/su. See pam_group(8) for details on how to modify this
setting.

so, pam seems reconfigured from stock freebsd.
i do not however see the difference ..

 

[lubos]

so, pam seems reconfigured from stock freebsd.
i do not however see the difference ..

There is a line "auth requisite pam_group.so no_warn group=wheel root_only fail_safe", which on FreeBSD ends with "ruser" (only difference). I tried to append this word on FreeNAS, but it's removed after reboot. Deleting "ruser" on FreeBSD, however, doesn't matter, PAM outputs "assuming ruser" and forbids su to root.

Well, I guess it's on purpose. CLI is also accessible without password, so FreeNAS needs to be running on a secure machine at any rate.