Enabling su/sudo Access with Wheel Group

Use the id and groups commands to confirm your wheelgroup membership:

id
groups

Use sudo to become the root user:

sudo -i

Run chgrp to set the wheel group as the owner of /usr/bin/sudo and /usr/bin/su:

chgrp wheel /usr/bin/sudo /usr/bin/su

Use chmod to set the most secure permissions, and allow the root user and wheel group to execute sudo and su:

chmod 4110 /usr/bin/sudo /usr/bin/su

Run ls -l on either of those to confirm.

To modify or verify /etc/sudoers allows the wheel group to use sudo, use the visudo command:

visudo

We need a line that looks like this:

%wheel  ALL=(ALL)       ALL

It may already be there, or it may be there and commented out. It's usually down in the vicinity of the root line. Save changes to the file and exit. Use grep to verify the line is there.

grep wheel /etc/sudoers

Using the editor of your choice, uncomment or create an additional "auth" test below the line ending with pam_rootok.so. The line should look like this:

auth            required        pam_wheel.so use_uid

Create the sysadmin user and make them a member of the wheel group:

useradd -G wheel sysadmin

Running it this way would work too:

useradd sysadmin
usermod -aG wheel sysadmin

Now we can set the sysadmin user password:

passwd sysadmin

Verify sysadmin can execute su and sudo:

su - sysadmin
sudo tail -n1 /etc/shadow
su -l cloud_user
exit
exit

Create the sysuser user and do not make them a member of the wheel group:

useradd sysuser

Set the sysuser user password.

passwd sysuser

Verify sysuser cannot execute su and sudo:

su --login sysuser
sudo tail -n1 /etc/shadow
su -l cloud_user
exit
exit

The sudo and following su commands should have both failed.