Diagnose su Permission Errors Without Granting Unnecessary Access

A failure to run su is not automatically an SSH configuration problem. SSH remote login, local user switching with su, and delegated commands through sudo are separate controls. Diagnose the exact failure before changing privileges.

Record what failed

Note the command, target user and exact error without recording a password. A failure to execute the program, an authentication rejection and a policy denial are different cases. An ordinary account may intentionally be prohibited from switching to root.

Have an authorized administrator inspect the caller’s identity and groups, the installed su program, package integrity, filesystem mount restrictions, applicable PAM rules and relevant private logs. Do not respond by blindly adding set-user-ID permissions, replacing a binary, weakening PAM or granting broad sudo access.

WHM wheel-group policy

On systems where the PAM policy restricts su to a wheel group, an authorized administrator can review membership through WHM’s Manage Wheel Group Users interface. Add a user only when that user is approved for the resulting access, and retain a recovery session while verifying the intended policy.

Wheel membership is not a universal Linux requirement and does not automatically grant every sudo permission. cPanel documents a separate Manage Sudo Group Users interface on Ubuntu systems. Use the controls and privilege model for the installed operating system rather than treating those groups as interchangeable.

Do not enable root SSH as a workaround

The SSH PermitRootLogin setting governs direct remote root login, not the normal local su authentication path. Enabling remote root password login is not a general fix for a local switching error. If your hosting plan does not provide administrative access, use support’s authenticated process instead of attempting to bypass its restrictions.

After an approved correction, test only the intended privilege boundary and retain a non-secret record of the change. This article does not recommend adding every shell user to an administrative group.

References: WHM wheel-group scope and Ubuntu distinction; util-linux su authentication and PAM.

Reviewed October 15, 2026. Documentation review; no permissions, group memberships, PAM rules or SSH settings were changed.