I'm trying to disable su for call group ids (gid) which equal or greater than 1003.My solution was as below but it didn't work. It failed for users who in lesser gids as well.Failed solution:Edit /etc/pam.d/suAdd line,auth       required   pam_succeed_if.so quiet gid >= 1003Any idea why this fails?
How to disable su for group by using pam_succeed_if?
su;pam
Solved. I miss understand the concept. Actually I thought gid represent the group ids of user who trying to run the su command. But it really represent the destination use's group ids.