Question : Prevent sudoer users from using SU

If I have a group of users I want to all to use all commands, but I want them to use sudoers for auditing purposes, how can I set it up so that they cannot use SU and bypass sudo and the logging?
I am using the very primative ALL for them right now

# %ITstaff       ALL=(ALL)       NOPASSWD: ALL

Answer : Prevent sudoer users from using SU

You can't prevent people from using su by editing sudoers!

What you want is (maybe) to disable su to all users but root. This is done by editing the /etc/pam.d/su file and adding (or removing a comment)

auth       required   pam_wheel.so

Have a look at the file, some additional options are available.

But you still might want to allow only the exact commands with sudo together with the su restriction.

//jonas