# Too many users with root password

**URL:** <https://community.unix.com/t/too-many-users-with-root-password/251466>\
**Category:** UNIX Desktop Questions & Answers\
**Created:** [October 16, 2009, 7:44am UTC](https://community.unix.com/t/too-many-users-with-root-password/251466 "2009-10-16T07:44:38Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Giordano\_Bruno](https://community.unix.com/letter_avatar/giordano_bruno/32/5_5575768a8748004e209b776fc1b2916d.png) [@Giordano\_Bruno](https://community.unix.com/u/Giordano_Bruno)\
**Post date:** [October 16, 2009, 7:44am UTC](https://community.unix.com/t/too-many-users-with-root-password/251466/1 "2009-10-16T07:44:38Z")

</div>

Hi there,

I'm working with a Linux server and now I can get a daily Logwatch mail ... my question is:since there are too many users with root password (...in my opinion... :mad:) how could I prevent to delete information about "su" log?

Thanks in advance,

GB

---

<div class="post-metadata">

**Author:** ![TonyFullerMalv](https://community.unix.com/user_avatar/community.unix.com/tonyfullermalv/32/1090_2.png) [@TonyFullerMalv](https://community.unix.com/u/TonyFullerMalv)\
**Post date:** [October 16, 2009, 6:56pm UTC](https://community.unix.com/t/too-many-users-with-root-password/251466/2 "2009-10-16T18:56:26Z")

</div>

Or you could limit the use of the su command by setting up a Unix group of folk who are allowed access to the root account and limit the su command to being only run by members of that group and root itself and not be world executable or world readable? (Traditionally referred to as the [wheel](http://administratosphere.wordpress.com/2007/07/19/the-wheel-group/) group ).  
Make sure you catch all versions of su in your installation and ensure folk [cannot SSH in as root](http://http://www.ssh.com/support/documentation/online/ssh/adminguide/32/Configuring_Root_Logins.html).

---

<div class="post-metadata">

**Author:** ![jp2542a](https://community.unix.com/letter_avatar/jp2542a/32/5_5575768a8748004e209b776fc1b2916d.png) [@jp2542a](https://community.unix.com/u/jp2542a)\
**Post date:** [October 16, 2009, 9:29pm UTC](https://community.unix.com/t/too-many-users-with-root-password/251466/3 "2009-10-16T21:29:55Z")

</div>

Or you can use sudo and limit which commands users can run as root. This also forces people to log in with a non-privileged account first.

---

<div class="post-metadata">

**Author:** ![frank\_rizzo](https://community.unix.com/letter_avatar/frank_rizzo/32/5_5575768a8748004e209b776fc1b2916d.png) [@frank\_rizzo](https://community.unix.com/u/frank_rizzo)\
**Post date:** [October 16, 2009, 9:56pm UTC](https://community.unix.com/t/too-many-users-with-root-password/251466/4 "2009-10-16T21:56:29Z")

</div>

if the people with root access cannot be trusted then the removal of the su log is the least of your worries.

but... one thing you could do is setup a remote syslog server with limited access and configure all of the UNIX clients to log to that server. This would prevent the logs from being tampered with. Make sure the same people with root cannot access that server. This would only be part of the solution but might prove very useful.