STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must restrict the use of the "su" command.

DISA Rule

SV-274151r1120441_rule

Vulnerability Number

V-274151

Group Title

SRG-OS-000312-GPOS-00123

Rule Version

AZLX-23-002440

Severity

CAT II

CCI(s)

• CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.

Weight

10

Fix Recommendation

Configure Amazon Linux 2023 to require users to be in the "wheel" group to run "su" command.

In file "/etc/pam.d/su", uncomment the following line:

"#auth required pam_wheel.so use_uid"

$ sudo sed '/^[[:space:]]*#[[:space:]]*auth[[:space:]]\+required[[:space:]]\+pam_wheel\.so[[:space:]]\+use_uid$/s/^[[:space:]]*#//' -i /etc/pam.d/su

If necessary, create a "wheel" group and add administrative users to the group.

Check Contents

Verify Amazon Linux 2023 requires uses to be members of the "wheel" group with the following command:

$ grep pam_wheel /etc/pam.d/su
auth required pam_wheel.so use_uid

If a line for "pam_wheel.so" does not exist, or is commented out, this is a finding.

Vulnerability Number

V-274151

Documentable

False

Rule Version

AZLX-23-002440

Severity Override Guidance

Verify Amazon Linux 2023 requires uses to be members of the "wheel" group with the following command:

$ grep pam_wheel /etc/pam.d/su
auth required pam_wheel.so use_uid

If a line for "pam_wheel.so" does not exist, or is commented out, this is a finding.

Check Content Reference

M

Target Key

5700