{"id":1265,"date":"2021-10-02T14:09:01","date_gmt":"2021-10-02T14:09:01","guid":{"rendered":"https:\/\/pheonixsolutions.com\/knowledge-base\/?p=1265"},"modified":"2026-05-26T13:49:04","modified_gmt":"2026-05-26T13:49:04","slug":"how-to-disable-sudo-su-and-sudo-passwd-root-commands-for-wheel-group-users","status":"publish","type":"post","link":"https:\/\/pheonixsolutions.com\/knowledge-base\/2021\/10\/02\/how-to-disable-sudo-su-and-sudo-passwd-root-commands-for-wheel-group-users\/","title":{"rendered":"How to disable “sudo su -” and “sudo passwd root” commands for wheel group users."},"content":{"rendered":"\n
Introduction<\/h2>\n\n\n\n
In Linux systems, users who belong to the wheel<\/code> group are usually granted elevated privileges through sudo<\/code>. By default, these users may also be able to switch to the root account using sudo su -<\/code> or reset the root password using sudo passwd root<\/code>.<\/p>\n\n\n\n
For security and access-control purposes, administrators may want to prevent wheel group users from:<\/p>\n\n\n\n
\n
Switching directly to the root shell<\/li>\n\n\n\n
Changing the root account password<\/li>\n<\/ul>\n\n\n\n
This guide explains how to restrict these commands while still allowing users to perform permitted administrative tasks using sudo<\/code>.<\/p>\n\n\n\n\n\n\n\n
Prerequisites<\/h1>\n\n\n\n
Before proceeding, ensure the following requirements are met:<\/p>\n\n\n\n
\n
Root or administrative access to the server<\/li>\n\n\n\n
A Linux server with sudo<\/code> installed<\/li>\n\n\n\n
Basic knowledge of Linux command-line operations<\/li>\n\n\n\n
Access to edit the \/etc\/sudoers<\/code> file safely using visudo<\/code><\/li>\n\n\n\n
Existing wheel<\/code> group configured in the system<\/li>\n<\/ul>\n\n\n\n\n\n\n\n
Step 1: Create a New User<\/h1>\n\n\n\n
Create a new user account.<\/p>\n\n\n\n
# adduser pheonix\n<\/code><\/pre>\n\n\n\n
Set a password for the user.<\/p>\n\n\n\n
# passwd pheonix\n<\/code><\/pre>\n\n\n\n
\n
Note:<\/strong> Replace pheonix<\/code> with your preferred username.<\/p>\n<\/blockquote>\n\n\n\n\n\n\n\n
Step 2: Add the User to the Wheel Group<\/h1>\n\n\n\n
Add the user to the wheel<\/code> group to grant sudo privileges.<\/p>\n\n\n\n
# gpasswd -a pheonix wheel\n<\/code><\/pre>\n\n\n\n
Verify the group membership:<\/p>\n\n\n\n
# groups pheonix\n<\/code><\/pre>\n\n\n\n\n\n\n\n
Step 3: Configure Sudo Restrictions<\/h1>\n\n\n\n
Open the sudoers configuration file using visudo<\/code>.<\/p>\n\n\n\n
# visudo\n<\/code><\/pre>\n\n\n\n
Locate the following line:<\/p>\n\n\n\n
%wheel ALL=(ALL) ALL\n<\/code><\/pre>\n\n\n\n
Replace it with:<\/p>\n\n\n\n
Cmnd_Alias BLOCKSU = \/bin\/su, \/usr\/bin\/passwd root\n\n%wheel ALL=(ALL) ALL, !BLOCKSU\n<\/code><\/pre>\n\n\n\n<\/figure>\n\n\n\n\n\n\n\n
Step 4: Save and Exit<\/h1>\n\n\n\n
Save the file and exit the editor.<\/p>\n\n\n\n
If using vi\/vim<\/code>:<\/p>\n\n\n\n
:wq\n<\/code><\/pre>\n\n\n\n\n\n\n\n
Step 5: Verify the Restrictions<\/h1>\n\n\n\n
Login with the wheel user and test the commands.<\/p>\n\n\n\n
Test sudo su -<\/code><\/h2>\n\n\n\n
$ sudo su -\n<\/code><\/pre>\n\n\n\n
Expected output:<\/p>\n\n\n\n
Sorry, user pheonix is not allowed to execute '\/bin\/su' as root.\n<\/code><\/pre>\n\n\n\n\n\n\n\n
Test sudo passwd root<\/code><\/h2>\n\n\n\n
$ sudo passwd root<\/code><\/pre>\n\n\n\n
Expected output:<\/p>\n\n\n\n
Sorry, user pheonix is not allowed to execute '\/usr\/bin\/passwd root' as root.\n<\/code><\/pre>\n\n\n\n<\/figure>\n\n\n\n\n\n\n\n
Important Notes<\/h1>\n\n\n\n
\n
Always use visudo<\/code> instead of directly editing \/etc\/sudoers<\/code> to avoid syntax errors.<\/li>\n\n\n\n
Incorrect sudoers configuration can lock out administrative access.<\/li>\n\n\n\n
These restrictions only block specified commands and do not remove other sudo privileges.<\/li>\n<\/ul>\n\n\n\n\n\n\n\n
Conclusion<\/h1>\n\n\n\n
By configuring command restrictions in the sudoers<\/code> file, administrators can improve system security and prevent wheel group users from gaining unrestricted root access or modifying the root password.<\/p>\n\n\n\n
This approach helps enforce the principle of least privilege while still allowing controlled administrative operations through sudo<\/code>.<\/p>\n","protected":false},"excerpt":{"rendered":"
Introduction In Linux systems, users who belong to the wheel group are usually granted elevated privileges through sudo. By default, these users may also be able to switch to the root account using sudo su – or reset the root password using sudo passwd root. For security and access-control purposes, administrators may want to prevent ..<\/p>\n
![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2021\/10\/Screen-Shot-2021-10-02-at-7.17.37-PM-1024x330.png\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2021\/10\/123456789-1024x180.png\")
<\/figure>\n\n\n\n