topic Re: restricting access in Operating System - HP-UX

restricting access

trystan macdonald — Fri, 07 Feb 2003 12:14:58 GMT

Hi,
Does anyone now how to quickly restrict login access to root and informix users without deleting other accounts on the system.
Thanks,
Trystan.

Re: restricting access

Pete Randall — Fri, 07 Feb 2003 12:21:50 GMT

Trystan,

Well, there's the nologin feature of /etc/default/security, but that keeps everyone but root out. For more granularity, you would need to have a global login script (like /etc/profile) and do some sort of checking in there, like for the presence of a file called /etc/justrootandinformix, and do an exit for everyone else.

Pete

Re: restricting access

Robert-Jan Goossens — Fri, 07 Feb 2003 12:23:30 GMT

Hi Trystan,

root login only on console and su -

#echo console >> /etc/securetty

informix,
take a look at next link,
http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x59d7cdec06f1d61190050090279cd0f9,00.html

Robert-Jan.

Re: restricting access

Thierry Poels_1 — Fri, 07 Feb 2003 12:25:56 GMT

Hi,

- vipw and add comment sign (or anything else) to username or password for non-administrative users. Remove this later to allow access again.

- edit /etc/profile: check on loginname and exit if different from root,informix,...

- ...

Stay logged in on one terminal, and test login. Don't lock yourself out.

good luck,
Thierry.

Re: restricting access

Steven E. Protter — Fri, 07 Feb 2003 14:11:22 GMT

Just a little note. Any user id below 100 is for the system. Don't mess with those. If you delete them your system could have a major malfuncion. Don't change their entries in /etc/profile because they need the priviledges they have.

You can set up a file called /var/adm/inetd.sec

This can let you fine tune who can access the system by what protocol and where.

If this is a security issue, you might find the Bastille security hardeninig utility of use. I've included a link.

https://payment.ecommerce.hp.com/cgi-bin/swdepot_parser.cgi/cgi/try.pl?productNumber=B6849AA&date=

P