Stop user login

[John Mak]

Hi Admins,

I want to lock out all but three users (root, admin1 and admin2) from a system during a maintenance window.

I have considered using the NOLOGIN=1 in /etc/default/security and /etc/nologin . Since I cannot allow admin1 and admin2 to login when this has been set I have ruled it out.

My current plan was to use following script in /etc/profile

user=`whoami`
if [ $user != root ] -o [ $user != admin1 ] -o [ $user != admin2 ]
then
echo "System is currently undergoing maintenance"
exit
fi

However the test is not behaving as I thought it would. Can somebody please help me with my code or suggest an alternative solution?

Thanks

[Steven Schweda]

As usual, it might help to know what
happened. ("[N]ot behaving as I thought it
would" is not as informative as you might
think.) I'll assume that it prints out the
message for the low-class users, and then
continues as if nothing were special. I'd
guess that that's because "exit" in a script
like this is what happens normally. Perhaps
"logout", or "kill -HUP 0", or something
comparably vicious (depending on the shell)
would do something new and different.

[John Mak]

Hi,

Exit is working as expected. Itâ s the test for the if statement thatâ s not working.

It only checks the first condition[ $user != root ] and does not consider the second or third test.

From my interpretation it should read

If $user not equal to root OR $user not equal to admin1 OR $user not equal to admin2
# at this point it only checks the first test
then
echo "System is currently undergoing maintenance"
exit
fi

[Dennis Handly · Accepted solution]

Your condition is wrong. You will allow NOBODY to login!

The correct logic is:
if [ $user != root ] -a [ $user != admin1 ] -a [ $user != admin2 ]; then

Or better yet if you have problems with boolean arithmetic: ;-)
if [ $user = root ] -o [ $user = admin1 ] -o [ $user != admin2 ]; then
: # allow VIPs
else
echo "System is currently undergoing maintenance"
exit
fi

[Dennis Handly]

Oops, that's:
Your condition is wrong. You will allow NOBODY to login!

The correct logic is:
if [ $user != root -a $user != admin1 -a $user != admin2 ]; then

Or better yet if you have problems with boolean arithmetic: ;-)
if [ $user = root -o $user = admin1 -o $user != admin2 ]; then
: # allow VIPs
else
echo "System is currently undergoing maintenance"
exit
fi

[John Mak]

You guys rock!

If anyone is interested this is the final product

user=`whoami`
if [ $user != root -a $user != admin1 -a $user != admin2 ]
then
echo "System is currently undergoing maintenance"
exit
fi

Thanks for the help.

[Dennis Handly]

Double oops:
Or better yet if you have problems with boolean arithmetic: ;-)
if [ $user = root -o $user = admin1 -o $user = admin2 ]; then