Anyone know how to disable SU right for a particular user in Solaris 8
try with an acl (Acces Control List) for the command su. Deny rwx for the user that you want
One common approach is to create a group called "wheel". Then:
chgrp wheel /usr/bin/su
chmod 4550 /usr/bin/su
Now su can be run by root and by members of the group wheel. So you put some users in that group to allow them access to the su command.
It is traditional to call the group "wheel", but I don't know where that name came from. Possibly from "big wheel" which is slang for important person?
You should not change the default file permissions and/or group of Solaris binaries, instead you should use RBAC and turn non-personal accounts into roles. Then you have to assign explicit permission to be able to assume the role (i.e. "su - role").
If you describe what problem you are trying to it is easier to suggest a good solution.
Unless your root, you need to know the password for the account you're su'ing to. If I know the account's password, I don't need to su, I can simply login to the account as a normal user. Can you change passwords so that the user does not have access to any accounts that are not his/hers?
Simply denying access to su will only stop a user from switching user accounts. It will not stop the user performing an interactive login into the specified account, which has the same end result.