How to grant su access to wheel without asking for password on FreeBSD?

Question

I would like to grant users of the wheel group (other sysadmins) su access without being asked for password.

I know how to do it with pam in linux, but the question now is for FreeBSD. I am not familiar with the syntax for FreeBSD's PAM subsystem. What shall I enter in /etc/pam.d/su instead of the default:

auth         sufficient   pam_rootok.so   no_warn
auth         sufficient   pam_self.so     no_warn
auth         requisite    pam_group.so    no_warn group=wheel root_only fail_safe ruser
auth         include      system

# account
account      include      system

# session
session      required     pam_permit.so

score 5 · Accepted Answer · answered Mar 23 '12 at 13:47

I did some error and trial and the solution for me seems to be like this:

# auth
auth            sufficient      pam_rootok.so           no_warn
auth            sufficient      pam_self.so             no_warn
auth            requisite       pam_group.so            no_warn group=wheel root_only fail_safe ruser
auth            sufficient      pam_group.so            no_warn group=wheel root_only fail_safe ruser
auth            include         system

# account
account         include         system

# session
session         required        pam_permit.so

This allows members of the wheel group to su without password, but disallows non-members. (I think the two line can be consolidated into one, but I did not bother that much.)

You can just delete or comment out the first line, as it's overruled by the second. — Ingmar Hupp, Feb 13 '13 at 16:46

score 2 · Answer 2 · edited Mar 23 '12 at 13:49

2

sudo is configured by sudoers file and visudo should be used to edit.

visudo -f /usr/local/etc/sudoers

Make sure you have this line uncommented:

%wheel ALL=(ALL) NOPASSWD: ALL

edited Mar 23 '12 at 13:49

cstamas

6,707
25
42

answered Mar 22 '12 at 16:03

johnshen64

5,865
24
17

3

I do not want to use sudo as it is not in FreeBSD (it is not part of the base system). I know it is possible with PAM and I want to use that. – cstamas Mar 22 '12 at 21:49
OTOH: I corrected the syntax for visudo. – cstamas Mar 23 '12 at 13:49

How to grant su access to wheel without asking for password on FreeBSD?

2 Answers2