From owner-freebsd-questions@FreeBSD.ORG Fri Sep 29 07:41:47 2006 Return-Path: X-Original-To: freebsd-questions@freebsd.org Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 8025216A586 for ; Fri, 29 Sep 2006 07:41:47 +0000 (UTC) (envelope-from arcade@synergetica.dn.ua) Received: from nora.synergetica.dn.ua (synergetica.dn.ua [82.207.115.117]) by mx1.FreeBSD.org (Postfix) with ESMTP id 55C7C43D6E for ; Fri, 29 Sep 2006 07:41:40 +0000 (GMT) (envelope-from arcade@synergetica.dn.ua) Received: from [172.30.0.159] (yarn.lan [172.30.0.159]) (authenticated bits=0) by nora.synergetica.dn.ua (8.13.8/8.13.8) with ESMTP id k8T7fbjc054444 for ; Fri, 29 Sep 2006 10:41:38 +0300 (EEST) (envelope-from arcade@synergetica.dn.ua) Message-ID: <451CCDF3.1050005@synergetica.dn.ua> Date: Fri, 29 Sep 2006 10:40:35 +0300 From: Volodymyr Kostyrko User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; ru-RU; rv:1.8.0.7) Gecko/20060918 SeaMonkey/1.0.5 MIME-Version: 1.0 To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: ENABLE_SUID_K5SU and ksu behavior X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 29 Sep 2006 07:41:47 -0000 I don't get it... The behavior of 'ksu' is entirely different from 'su'. It doesn't check whether user is listed in wheel group - it just lets user in if he knows password. And when there's no root password (sometimes it's much easier to add to wheel group all who is responsible while all other are left out) it just lets anyone in unconditionally. It seems that ordinary su works through pam, while ksu doesn't... What am I missing? -- [WBR], Arcade.