From owner-freebsd-security@FreeBSD.ORG  Tue Sep 27 14:09:32 2011
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 3408E1065672;
	Tue, 27 Sep 2011 14:09:32 +0000 (UTC)
	(envelope-from mail25@bzerk.org)
Received: from ei.bzerk.org (tunnel490.ipv6.xs4all.nl
	[IPv6:2001:888:10:1ea::2])
	by mx1.freebsd.org (Postfix) with ESMTP id B21998FC1A;
	Tue, 27 Sep 2011 14:09:31 +0000 (UTC)
Received: from ei.bzerk.org (BOFH@localhost [127.0.0.1])
	by ei.bzerk.org (8.14.4/8.14.4) with ESMTP id p8RE9JJC081216
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT);
	Tue, 27 Sep 2011 16:09:19 +0200 (CEST)
	(envelope-from mail25@bzerk.org)
Received: (from bulk@localhost)
	by ei.bzerk.org (8.14.4/8.14.4/Submit) id p8RE9ITO081215;
	Tue, 27 Sep 2011 16:09:18 +0200 (CEST)
	(envelope-from mail25@bzerk.org)
Date: Tue, 27 Sep 2011 16:09:18 +0200
From: Ruben de Groot <mail25@bzerk.org>
To: Lev Serebryakov <lev@freebsd.org>
Message-ID: <20110927140918.GA80848@ei.bzerk.org>
References: <679126918.20110922121706@serebryakov.spb.ru>
	<86d3esy554.fsf@ds4.des.no>
	<964986730.20110923230802@serebryakov.spb.ru>
	<86r5369mgb.fsf@ds4.des.no>
	<fdcf96078c3af70fcb7ca89a20d747d8@canyon.xs4all.nl>
	<122856284.20110926194432@serebryakov.spb.ru>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <122856284.20110926194432@serebryakov.spb.ru>
User-Agent: Mutt/1.4.2.3i
X-Spam-Status: No, score=-4.4 required=5.0 tests=ALL_TRUSTED,BAYES_00
	autolearn=ham version=3.2.5
X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on ei.bzerk.org
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.0.1
	(ei.bzerk.org [127.0.0.1]); Tue, 27 Sep 2011 16:09:27 +0200 (CEST)
X-Mailman-Approved-At: Tue, 27 Sep 2011 15:44:17 +0000
Cc: Rene de Vries <rene@canyon.xs4all.nl>, freebsd-security@freebsd.org
Subject: Re: pam_ldap and nss_ldap : checken and egg problem with "wheel"
	group and "su" utility
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "Security issues \[members-only posting\]"
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 27 Sep 2011 14:09:32 -0000

On Mon, Sep 26, 2011 at 07:44:32PM +0400, Lev Serebryakov typed:
> Hello, Rene.
> You wrote 26 ???????????????? 2011 ??., 15:07:09:
> 
> > Why not have /etc/group be authoritive for wheel (an thus have a list 
> > of local superusers).
>   Idea is to have no local users (but root) at all :)

How about creating an ldap group 'su-users' and changing /etc/pam.d/su
to have the line:

auth requisite pam_group.so no_warn group=su-users root_only fail_safe