---
title: "HOST-PAM-003 su Not Restricted to an Administrative Group"
canonical: https://openvapt.com/checks/HOST-PAM-003.html
html: https://openvapt.com/checks/HOST-PAM-003.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-PAM-003 su Not Restricted to an Administrative Group

Checks that only members of a named group (wheel or sudo) may use su to become another user.

- Domain: Server
- Severity: Low
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N`
- CIS Controls v8: 5.4
- NIST CSF 2.0: PR.AA-05
- CWE: CWE-250, CWE-862
- NIST SP 800-53 Rev. 5: AC-6(2), AC-3
- Benchmark topic: Access to the su command is restricted (CIS Controls v8 5.4) (topic only, no benchmark text)

## Why It Matters

Without pam_wheel, every local account, including a compromised web service user, can run su and start guessing the root password. Restricting su to an administrative group removes that path and leaves sudo, which logs each command, as the way to gain privilege.

## How It Detects

Reads /etc/pam.d/su for an active line  auth required pam_wheel.so  (any control value, with or without use_uid and group=). Skipped when the file does not exist; Incomplete when it cannot be read.

## How to Fix

In /etc/pam.d/su uncomment or add  auth required pam_wheel.so use_uid group=sudo  (group=wheel on the RHEL family), and make sure the group contains only administrators. Caution: add every administrator who uses su to that group first and test from a second session, or they lose su access.

## How to Verify

```
grep -E '^auth\s+required\s+pam_wheel.so' /etc/pam.d/su
```

## Learn the Theory

- [P22 Authentication Policy and Package Hygiene](https://openvapt.com/academy/p22.md)

## References

- [pam_wheel(8), Linux-PAM](https://man7.org/linux/man-pages/man8/pam_wheel.8.html)
- [NIST SP 800-53 Rev. 5, Security and Privacy Controls](https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/pam_login.go

Run it: `openvapt scan --only HOST-PAM-003`. Read it offline: `openvapt explain HOST-PAM-003`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-PAM-003.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.