nerdexam
Linux_Foundation

LFCS · Question #417

On a new Linux system, the root user is being asked to provide the root user password before being able to use the su command. What line in the /etc/pam.d/su file will allow root to use su without…

The correct answer is D. auth sufficient pam_rootok.so. To allow the root user to use su without a password, the /etc/pam.d/su file needs to include the pam_rootok.so module with a sufficient control flag.

Submitted by obi.ng· Apr 18, 2026User and Group Management

Question

On a new Linux system, the root user is being asked to provide the root user password before being able to use the su command. What line in the /etc/pam.d/su file will allow root to use su without supplying passwords?

Options

  • Aauth required pam_norootpw.so
  • Bauth sufficient pam_norootpw.so
  • Cauth required pam_rootok.so
  • Dauth sufficient pam_rootok.so

How the community answered

(49 responses)
  • A
    6% (3)
  • B
    10% (5)
  • C
    4% (2)
  • D
    80% (39)

Why each option

To allow the root user to use `su` without a password, the `/etc/pam.d/su` file needs to include the `pam_rootok.so` module with a `sufficient` control flag.

Aauth required pam_norootpw.so

`pam_norootpw.so` is not a standard or commonly used PAM module for this purpose, and `required` would still necessitate other authentication methods.

Bauth sufficient pam_norootpw.so

Similar to A, `pam_norootpw.so` is not the correct PAM module for this functionality.

Cauth required pam_rootok.so

While `pam_rootok.so` is the correct module, using `required` would mean that even if root is successfully authenticated by this module, other `required` or `requisite` modules in the stack would still need to succeed, potentially leading to a password prompt.

Dauth sufficient pam_rootok.soCorrect

The `pam_rootok.so` module checks if the user is root (UID 0), and when combined with the `sufficient` control flag, it allows the root user to authenticate successfully without further authentication steps for `su`, bypassing the password prompt.

Concept tested: PAM `su` configuration for root

Source: https://manpages.debian.org/unstable/libpam-doc/pam_rootok.8.en.html

Topics

#PAM#su command#Authentication#Root user

Community Discussion

No community discussion yet for this question.

Full LFCS Practice