HardenedBSD/etc/pam.d/su

#
# $FreeBSD$
#
# PAM configuration for the "su" service
#

# auth
auth		sufficient	pam_rootok.so		no_warn
auth		sufficient	pam_self.so		no_warn
auth		requisite	pam_group.so		no_warn group=wheel root_only fail_safe ruser
auth		include		system

# account
account		include		system

# session
session		required	pam_permit.so
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 22:06:21 +01:00			`#`
			`# $FreeBSD$`
			`#`
			`# PAM configuration for the "su" service`
			`#`

			`# auth`
Major cleanup & homogenization. 2003-02-10 01:50:03 +01:00			`auth sufficient pam_rootok.so no_warn`
			`auth sufficient pam_self.so no_warn`
Forgot to commit this change along with r219563: pam_group(8) now issues a warning if neither luser nor ruser is specified. The correct option for su(1) is ruser. MFC after: 1 month 2011-03-15 11:13:35 +01:00			`auth requisite pam_group.so no_warn group=wheel root_only fail_safe ruser`
Add a system policy, and have the login and su policies include it rather than duplicate it. This requires OpenPAM Dianthus, which was committed two weeks ago; installing these files on a system running a world older than June 1st, 2003 will cause login(1) and su(1) to fail. 2003-06-14 14:35:05 +02:00			`auth include system`
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 22:06:21 +01:00
			`# account`
Add a system policy, and have the login and su policies include it rather than duplicate it. This requires OpenPAM Dianthus, which was committed two weeks ago; installing these files on a system running a world older than June 1st, 2003 will cause login(1) and su(1) to fail. 2003-06-14 14:35:05 +02:00			`account include system`
pam.d-style configuration, auto-generated from pam.conf. Sponsored by: DARPA, NAI Labs 2001-12-05 22:06:21 +01:00
			`# session`
Don't do session management in su. PR: misc/53293 Submitted by: ru 2003-07-09 20:40:49 +02:00			`session required pam_permit.so`