fedora-docs-l10n/fedora-system-administrat/f30/pages/basic-system-configuration/Gaining_Privileges

Zen

	English	French	Actions
	When a user executes the [command]#su# command, they are prompted for the `root` password and, after authentication, are given a `root` shell prompt.
	Once logged in using the [command]#su# command, the user is the `root` user and has absolute administrative access to the system. Note that this access is still subject to the restrictions imposed by SELinux, if it is enabled. In addition, once a user has become `root`, it is possible for them to use the [command]#su# command to change to any other user on the system without being prompted for a password.
	Because this program is so powerful, administrators within an organization may want to limit who has access to the command.
	One of the simplest ways to do this is to add users to the special administrative group called _wheel_. To do this, type the following command as `root`:
	~]# usermod -a -G wheel pass:quotes[_username_]
	In the previous command, replace _username_ with the user name you want to add to the `wheel` group.
	You can also use the [application]Users settings tool to modify group memberships, as follows. Note that you need administrator privileges to perform this procedure.
	Press the kbd:[Super] key to enter the Activities Overview, type [command]#Users# and then press kbd:[Enter]. The [application]Users settings tool appears. The kbd:[Super] key appears in a variety of guises, depending on the keyboard and other hardware, but often as either the Windows or Command key, and typically to the left of the kbd:[Spacebar].
	To enable making changes, click the btn:[Unlock] button, and enter a valid administrator password.
	Click a user icon in the left column to display the user's properties in the right-hand pane.
	Change the Account Type from `Standard` to `Administrator`. This will add the user to the `wheel` group.
	See xref:basic-system-configuration/Managing_Users_and_Groups.adoc#s1-users-configui[Managing Users in a Graphical Environment] for more information about the [application]Users tool.
	After you add the desired users to the `wheel` group, it is advisable to only allow these specific users to use the [command]#su# command. To do this, edit the PAM configuration file for [command]#su#, `/etc/pam.d/su`. Open this file in a text editor and uncomment the following line by removing the `#` character:
	#auth required pam_wheel.so use_uid
	This change means that only members of the administrative group `wheel` can switch to another user using the [command]#su# command.
	Note
	The `root` user is part of the `wheel` group by default.
	The sudo Command
	The [command]#sudo# command offers another approach to giving users administrative access. When trusted users precede an administrative command with [command]#sudo#, they are prompted for their own password. Then, when they have been authenticated and assuming that the command is permitted, the administrative command is executed as if they were the `root` user.
	The basic format of the [command]#sudo# command is as follows:
	[command]#sudo# _command_
	In the above example, _command_ would be replaced by a command normally reserved for the `root` user, such as [command]#mount#.
	The [command]#sudo# command allows for a high degree of flexibility. For instance, only users listed in the `/etc/sudoers` configuration file are allowed to use the [command]#sudo# command and the command is executed in the user's shell, not a `root` shell. This means the `root` shell can be completely disabled as shown in the link:++https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/++[Red{nbsp}Hat Enterprise{nbsp}Linux{nbsp}7 Security Guide].
	Each successful authentication using the [command]#sudo# command is logged to the file `/var/log/messages` and the command issued along with the issuer's user name is logged to the file `/var/log/secure`. If additional logging is required, use the `pam_tty_audit` module to enable TTY auditing for specified users by adding the following line to your `/etc/pam.d/system-auth` file:
	session required pam_tty_audit.so disable=pass:quotes[_pattern_] enable=pass:quotes[_pattern_]
	where _pattern_ represents a comma-separated listing of users with an optional use of globs. For example, the following configuration will enable TTY auditing for the `root` user and disable it for all other users:
	session required pam_tty_audit.so disable=* enable=root
	Another advantage of the [command]#sudo# command is that an administrator can allow different users access to specific commands based on their needs.
	Administrators wanting to edit the [command]#sudo# configuration file, `/etc/sudoers`, should use the [command]#visudo# command.
	To give someone full administrative privileges, type [command]#visudo# and add a line similar to the following in the user privilege specification section:
	juan ALL=(ALL) ALL

Loading…

mt:weblate-translation-memory Suggestion added fedora-docs-l10n/fedora-system-administrat f30/pages/basic-system-configuration/Gaining_Privileges French	English Note French 4 characters edited Note 4 months ago
None String updated in the repository fedora-docs-l10n/fedora-system-administrat f30/pages/basic-system-configuration/Gaining_Privileges French	English Note French 4 characters edited Current translation Empty ~~Note~~ 4 months ago
None Suggestion removed during cleanup fedora-docs-l10n/fedora-system-administrat f30/pages/basic-system-configuration/Gaining_Privileges French	English Note French 4 characters edited Note 4 years ago
julroy67 Suggestion accepted fedora-docs-l10n/fedora-system-administrat f30/pages/basic-system-configuration/Gaining_Privileges French	English Note French 4 characters edited Note 4 years ago
None Suggestion added fedora-docs-l10n/fedora-system-administrat f30/pages/basic-system-configuration/Gaining_Privileges French	English Note French 4 characters edited Note 4 years ago