# Ensure access to the su command is restricted

Necessity: The 'su' (substitute user) command allows a user to switch to another user account, most critically the root superuser account. Restricting its use is a fundamental security practice based on the principle of least privilege. By default, any user can attempt to use 'su' to become root if they know the password. This creates a broad attack surface where any compromised user account becomes a potential vector for privilege escalation. Restricting 'su' access to a specific administrative group (the 'wheel' group) ensures that only explicitly authorized administrators can attempt to gain root privileges, significantly reducing the risk of unauthorized escalation.

Auditing and Remediation: The audit script verifies the system's Pluggable Authentication Module (PAM) configuration for the 'su' service. It specifically checks if the 'pam_wheel.so' module is activated, which enforces the rule that only members of the 'wheel' group can use the command. The remediation script directly modifies the '/etc/pam.d/su' configuration file to either enable this restriction by uncommenting or adding the required line, or disable it by commenting it out.

Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Enabled'. This is a binary security control; it is either securely configured or it is not. Basic security requires limiting privilege escalation pathways. Moderate and Strict levels maintain this configuration as it is a foundational control. The differentiation in strictness for privilege escalation would be managed by the separate, rigorous auditing of the 'wheel' group's membership, not by disabling this essential control.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Enabled']` |
| **Moderate** | `['Enabled']` |
| **Strict** | `['Enabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the PAM configuration for the 'su' service in '/etc/pam.d/su'. The script must check for the line 'auth required pam_wheel.so use_uid'. If this line exists and is not commented out, the script should output the string 'Enabled'. Otherwise, it should output 'Disabled'. The script's output must consist solely of the resulting string.

## Remediation Script Working

Bash script that accepts a single positional command-line argument: 'Enabled' or 'Disabled'. If the argument is 'Enabled', the script must ensure the line 'auth required pam_wheel.so use_uid' is present and not commented out in '/etc/pam.d/su'. If the argument is 'Disabled', the script must ensure the line is commented out. The script must output 'true' on success or 'false' on failure.

