common: prevent normal users from running su

2018-06-13 14:43:13 +02:00 · 2018-06-13 14:43:13 +02:00 · b570b30ad2
commit b570b30ad2
parent e5e92ebb44
1 changed files with 6 additions and 0 deletions
--- a/roles/common/tasks/Debian.yml
+++ b/roles/common/tasks/Debian.yml
@ -62,3 +62,9 @@
 - name: Disable hibernation/resume
  copy: src=resume dest=/etc/initramfs-tools/conf.d/resume
  notify: update-initramfs
+
+- name: Prevent normal users from running su
+  lineinfile:
+    path: /etc/pam.d/su
+    regexp: '^# auth       required   pam_wheel.so$'
+    line: 'auth       required   pam_wheel.so'