LFCS · Question #417
On a new Linux system, the root user is being asked to provide the root user password before being able to use the su command. What line in the /etc/pam.d/su file will allow root to use su without…
The correct answer is D. auth sufficient pam_rootok.so. To allow the root user to use su without a password, the /etc/pam.d/su file needs to include the pam_rootok.so module with a sufficient control flag.
Question
Options
- Aauth required pam_norootpw.so
- Bauth sufficient pam_norootpw.so
- Cauth required pam_rootok.so
- Dauth sufficient pam_rootok.so
How the community answered
(49 responses)- A6% (3)
- B10% (5)
- C4% (2)
- D80% (39)
Why each option
To allow the root user to use `su` without a password, the `/etc/pam.d/su` file needs to include the `pam_rootok.so` module with a `sufficient` control flag.
`pam_norootpw.so` is not a standard or commonly used PAM module for this purpose, and `required` would still necessitate other authentication methods.
Similar to A, `pam_norootpw.so` is not the correct PAM module for this functionality.
While `pam_rootok.so` is the correct module, using `required` would mean that even if root is successfully authenticated by this module, other `required` or `requisite` modules in the stack would still need to succeed, potentially leading to a password prompt.
The `pam_rootok.so` module checks if the user is root (UID 0), and when combined with the `sufficient` control flag, it allows the root user to authenticate successfully without further authentication steps for `su`, bypassing the password prompt.
Concept tested: PAM `su` configuration for root
Source: https://manpages.debian.org/unstable/libpam-doc/pam_rootok.8.en.html
Topics
Community Discussion
No community discussion yet for this question.