On Tue, 5 Feb 2008, Eric F Crist wrote: > You said you would disallow doing a sudo to su. You said nothing about > disallowing other commands. My point is that there are other ways to > obtain a root shell without going the su route. As someone else > mentioned, vim, emacs, poorly written shell scripts dumped into $PATH, > etc. The more secure, or safer, method may be to white-list rather than > black-list. At least, that's been my experience. I think you have to use an disallow-all, allow-specifics kind of approach. What about this? sudo cp -p /usr/bash /usr/bash2 sudo bash2 -l If bash had been disallowed, but bash2 hadn't been disallowed, then you're screwed. I think you have to allow a very limited set of commands, very cautiously. It's probably best to create a special user, not called root, in a special group who has certain special permissions -- can't that be done? Mike