Linux での su 認証エラーのトラブルシューティング

Introduction

The "su" (substitute user) command in Linux is a powerful tool that allows users to temporarily switch to a different user account, often the root user, to perform administrative tasks. However, su authentication failures can occur, leading to access denials and potential security risks. This tutorial will guide you through the process of troubleshooting su authentication failures on Linux, covering common causes, configuration settings, and best practices for secure su usage.

Understanding the Su Command and Basic Usage

The su command in Linux allows users to switch their current user identity to another user. This is particularly useful for performing administrative tasks that require elevated privileges.

Let us explore the basic usage of the su command and understand how it works.

Basic Usage of Su

Open a terminal in your LabEx VM environment. You can use the su command with the following syntax:

su [options] [username]

If you run su without specifying a username, it defaults to the root user:

su

You will be prompted for the root password. However, in many modern Linux distributions including Ubuntu, the root account is disabled by default for security reasons.

Let us create a test user to practice with:

sudo adduser testuser

Enter the required information when prompted. For simplicity, you can use "password" as the password for this test user.

Now, let us try to switch to this user:

su testuser

When prompted, enter the password you created for testuser. Once authenticated, your prompt will change, indicating you are now operating as testuser.

To verify that you have successfully switched users, run:

whoami

The output should show:

testuser

To return to your original user, simply type:

exit

Using Su with Options

The su command supports several options. The most common is the - (hyphen) option, which provides a full login environment:

su - testuser

This not only switches the user identity but also:

• Changes to the target user's home directory
• Sets up the environment variables of the target user
• Provides a login shell

Try this command and observe the differences:

pwd

The output should show the home directory of testuser:

/home/testuser

Exit from testuser by typing:

exit

This basic understanding of the su command will help us troubleshoot authentication failures in the next steps.

Common Su Authentication Failures and Their Causes

When using the su command, you might encounter authentication failures for various reasons. Understanding these failures is the first step toward resolving them.

Testing Authentication Failures

Let us intentionally create some authentication failures to better understand them:

1. Try switching to testuser with an incorrect password:

su testuser

Enter an incorrect password. You will see an error message similar to:

su: Authentication failure

2. Try switching to a non-existent user:

su nonexistentuser

You will see an error message like:

su: user nonexistentuser does not exist

Common Causes of Authentication Failures

1. Incorrect Password

The most common cause of authentication failure is simply entering the wrong password. This can happen due to:

• Typos
• Caps Lock being enabled
• Forgetting the password

2. Account Restrictions

Some accounts might be configured to prevent login or have expired passwords:

Let us modify our test user to demonstrate this:

sudo passwd -l testuser

This locks the password for testuser. Now try:

su testuser

You will see an authentication failure even if you enter the correct password.

Unlock the account with:

sudo passwd -u testuser

3. PAM Configuration Issues

The Pluggable Authentication Modules (PAM) system controls authentication in Linux. Issues with PAM configuration can cause su failures.

Let us examine the PAM configuration for the su command:

cat /etc/pam.d/su

This file contains the PAM configuration specific to the su command. Look for lines that might restrict access, such as:

auth       required   pam_wheel.so

This line, if uncommented, would restrict su access to members of the wheel group.

4. Permission Issues with the Su Binary

The su command's binary file must have the correct permissions to function properly:

ls -l $(which su)

The output should show something like:

-rwsr-xr-x 1 root root 71816 Apr 18  2022 /usr/bin/su

The s in the permissions indicates that the setuid bit is set, allowing the program to run with the privileges of its owner (root) rather than the user who runs it.

5. Examining Authentication Logs

When troubleshooting authentication failures, checking the system logs can provide valuable information:

sudo tail /var/log/auth.log

This command displays recent authentication events, including failed su attempts.

For example, a failed su attempt might show an entry like:

May 10 14:23:45 ubuntu su[12345]: FAILED su for root by labex

Understanding these common causes of su authentication failures will help you identify and resolve issues more effectively in the next steps.

Configuring Access Control for the Su Command

Linux provides several mechanisms to control who can use the su command. In this step, we will explore how to configure these access controls to enhance security.

Understanding the PAM Configuration

The Pluggable Authentication Modules (PAM) system is responsible for authentication in Linux. The configuration for the su command is stored in the /etc/pam.d/su file.

Let us examine this file in detail:

cat /etc/pam.d/su

The file contains various directives that control how authentication is performed. One important line to look for is:

auth       required   pam_wheel.so

If this line is uncommented (not starting with #), it restricts su access to members of the wheel group.

Restricting Su Access to Specific Groups

We can restrict the use of su to switch to root to members of a specific group. This is a common security practice.

First, let us create a new group called sugroup:

sudo groupadd sugroup

Next, add our test user to this group:

sudo usermod -aG sugroup testuser

Now, we need to modify the PAM configuration to restrict su access to members of this group:

sudo cp /etc/pam.d/su /etc/pam.d/su.bak

Now, open the PAM configuration file in the nano editor:

sudo nano /etc/pam.d/su

Look for a line similar to:

## auth       required   pam_wheel.so

Uncomment this line (remove the ## at the beginning) and modify it to use our sugroup instead of wheel:

auth       required   pam_wheel.so group=sugroup

Press Ctrl+O to save the file, then Ctrl+X to exit nano.

Testing the Configuration

Let us test our configuration by attempting to use su as a user who is not in the sugroup.

First, create another test user:

sudo adduser testuser2

Enter the required information when prompted.

Now, try to switch to the root user using testuser2:

su - testuser2

Enter the password for testuser2 when prompted.

Now try to switch to the root user:

su -

You should receive an authentication failure message, even if you enter the correct root password. This is because testuser2 is not a member of the sugroup.

Now switch back to your original user:

exit

And try using su with testuser, who is a member of the sugroup:

su - testuser

Enter the password for testuser when prompted.

Now try to switch to the root user:

su -

If you enter the correct root password, you should be able to switch to the root user successfully.

Reverting the Changes

For the purposes of completing the rest of this lab, let us revert our changes to the PAM configuration:

sudo cp /etc/pam.d/su.bak /etc/pam.d/su

This configuration allows you to control who can use the su command to switch to the root user, enhancing the security of your system.

Troubleshooting and Resolving Su Authentication Failures

Now that we understand common causes of su authentication failures and how to configure access control, let us focus on troubleshooting and resolving these failures.

Diagnosing Authentication Failures

When you encounter an su authentication failure, follow these systematic steps to diagnose the issue:

Step 1: Check the Error Message

The error message can provide valuable clues about the nature of the failure. Common error messages include:

• su: Authentication failure - Typically indicates an incorrect password.
• su: user username does not exist - The specified user account does not exist.
• su: permission denied - Access control restrictions are preventing the operation.

Step 2: Verify the User Account

Ensure that the target user account exists and is not locked:

grep testuser /etc/passwd

This should display the entry for testuser in the password file, confirming the account exists.

Check if the account is locked:

sudo passwd -S testuser

The output includes the status of the account. If it says "L" (locked), the account is locked.

Step 3: Check for Access Control Restrictions

As we learned in the previous step, PAM configuration can restrict su access. Check for such restrictions:

grep -v "^#" /etc/pam.d/su | grep pam_wheel

If this returns a line containing pam_wheel.so, access to su might be restricted to members of a specific group.

Step 4: Examine System Logs

The system logs can provide detailed information about authentication failures:

sudo tail -n 20 /var/log/auth.log

Look for entries related to su failures, which can provide additional context.

Resolving Common Su Authentication Failures

Now, let us address common su authentication failures and how to resolve them:

1. Incorrect Password

If you are entering the correct password but still getting authentication failures, the password might need to be reset:

sudo passwd testuser

Enter a new password for testuser when prompted.

2. Account Locked

If the account is locked, unlock it:

sudo passwd -u testuser

3. Access Control Restrictions

If access control restrictions are preventing su access, you can either:

a. Add the user to the required group:

sudo usermod -aG sugroup testuser2

This adds testuser2 to the sugroup.

b. Temporarily disable the restriction by commenting out the relevant line in the PAM configuration:

sudo sed -i 's/^auth\s\+required\s\+pam_wheel.so/#&/' /etc/pam.d/su

This command comments out the line containing pam_wheel.so in the su PAM configuration.

4. File Permission Issues

If the su binary has incorrect permissions, fix them:

sudo chmod u+s $(which su)

This ensures that the setuid bit is set on the su binary.

Testing the Fixes

After applying the fixes, test if su authentication works correctly:

su - testuser

Enter the password for testuser when prompted. If successful, you should now be logged in as testuser.

Try switching to the root user:

su -

If you have the root password and access control restrictions have been properly addressed, you should be able to switch to the root user successfully.

These troubleshooting steps and fixes address the most common su authentication failures. By systematically diagnosing and resolving these issues, you can ensure that the su command functions correctly on your system.

Best Practices for Secure Su Usage

In this final step, we will explore best practices for using the su command securely. Following these practices helps minimize security risks while still enabling administrative tasks to be performed effectively.

Use Sudo Instead of Su When Possible

The sudo command is generally considered more secure than su because:

• It allows for more granular control over permissions
• It logs commands executed with elevated privileges
• It does not require sharing the root password

Example of using sudo instead of su:

## Instead of:
su -
## Then entering commands as root

## Use:
sudo command

Try this example:

sudo ls /root

This executes the ls command with root privileges without switching to the root user.

Configure Sudo Access Properly

Ensure that sudo is configured correctly to grant only necessary privileges:

sudo visudo

This opens the sudoers file in a safe editor. The file should contain entries similar to:

## User privilege specification
root    ALL=(ALL:ALL) ALL

## Members of the sudo group may gain root privileges
%sudo   ALL=(ALL:ALL) ALL

Press Ctrl+X to exit without making changes.

Limit Direct Root Login

Discourage direct login as root, especially via SSH. Instead, users should log in with their regular accounts and use su or sudo when necessary.

Check if direct root login via SSH is disabled:

grep "PermitRootLogin" /etc/ssh/sshd_config

If this returns PermitRootLogin no, direct root login is properly disabled.

Implement Robust Password Policies

Ensure that the root password and passwords of users with su access are strong:

sudo apt-get install -y libpam-pwquality

This installs a PAM module for password quality checking.

Configure password policies by editing the PAM configuration:

sudo nano /etc/pam.d/common-password

Look for a line containing pam_pwquality.so and ensure it has appropriate parameters like:

password requisite pam_pwquality.so retry=3 minlen=12 difok=3

Press Ctrl+X to exit without making changes, as we are just examining the configuration.

Regularly Audit Su Usage

Review logs to monitor su usage:

sudo grep "su:" /var/log/auth.log | tail -n 10

This shows recent su attempts, both successful and failed.

Consider setting up automated alerts for multiple failed su attempts, which could indicate an attack.

Use Su with the Dash Option

When using su to switch to another user, especially root, use the dash (-) option to get a clean environment:

su - username

This provides a login shell with the target user's environment variables, which is more secure and prevents potential issues caused by inheriting the original user's environment.

Practice Session - Secure Su Usage

Let us practice these best practices:

1. Instead of using su - to become root and then running a command, use sudo:

## Instead of:
## su -
## cat /etc/shadow

## Use:
sudo cat /etc/shadow

2. Switch to testuser with a clean environment:

su - testuser

3. Exit back to your original user:

exit

4. Check the auth log for su usage:

sudo grep "su:" /var/log/auth.log | tail -n 5

By following these best practices, you can use the su command securely while minimizing potential security risks to your system.

Summary

In this lab, we explored the su command in Linux and learned how to troubleshoot common authentication failures. We covered:

1. Understanding the basic usage of the su command and how it works
2. Identifying common causes of su authentication failures, including incorrect passwords, account restrictions, and PAM configuration issues
3. Configuring access control for the su command to enhance security
4. Troubleshooting and resolving su authentication failures through systematic diagnosis
5. Implementing best practices for secure su usage, including using sudo when possible, configuring robust password policies, and regularly auditing su usage

By applying these techniques and best practices, you can ensure that the su command functions correctly while maintaining the security of your Linux system. Remember that proper authentication management is a crucial aspect of system administration and security.