限制用户使用su切换身份

[root@svr5 shell]# vim /etc/pam.d/su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
auth           required        pam_wheel.so use_uid    //将行首的#去掉使其成为有效行
auth            include         system-auth
account         sufficient      pam_succeed_if.so uid = 0 use_uid quiet
account         include         system-auth
password        include         system-auth
session         include         system-auth
session         optional        pam_xauth.so

[root@svr5 shell]# useradd lian
[root@svr5 shell]# useradd lian 1

[root@svr5 shell]# usermod -G 10 lian
[root@svr5 shell]# id lian
uid=500(lian) gid=500(lian) 组=500(lian),10(wheel)

[root@svr5 shell]# id lian1
uid=504(lian1) gid=505(lian1) 组=505(lian1)