topic Re: how can i limit some users only login in console in Operating System - HP-UX

how can i limit some users only login in console

郑刚_1 — Sun, 21 Dec 2003 21:55:34 GMT

i want to limit some user only login in console and can su to them.
or maybe can deny these users direct login but can su to them

Re: how can i limit some users only login in console

Michael Tully — Mon, 22 Dec 2003 00:58:51 GMT

You will need to place a restriction either in the /etc/profile file or the users account .profile ($HOME/.profile) below is an example posting which has some options you can use as a guide.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=274006

Re: how can i limit some users only login in console

Alan Turner — Mon, 22 Dec 2003 04:41:57 GMT

You can stop them loggin in by defining their shell to be /usr/bin/false.

You could also use SAM to deactivate the user - this would prevent their being able to login, but would also disable their password, so if you wanted to su to the user, you would first have to gain root privilege.

Re: how can i limit some users only login in console

Bruno Ganino — Mon, 22 Dec 2003 05:37:19 GMT

The file /etc/usertty specifies additional access restrictions for specific users.
(not applicable to login implementations that use PAM)
If this file does not exist, no additional access restrictions are imposed.
The file consists of a sequence of sections.
There are three possible section types: CLASSES, GROUPS and USERS.
I think that the USERS-SECTION can to be useful,.

See into your manual for explanations.

HTH
Bruno

Re: how can i limit some users only login in console

Abskhan — Mon, 22 Dec 2003 06:17:36 GMT

1]Put a check in the /etc/profile and find out from which IP and the userid the user is logging in and allow accrodingly.
2]if you want to deny direct console login then user /etc/securetty file.
3]Write a small script checking which users u want to allow to do su or use program like sudo which can be downloaded.

Re: how can i limit some users only login in console

郑刚_1 — Mon, 22 Dec 2003 20:11:51 GMT

please give me more info for /etc/usertty

Re: how can i limit some users only login in console

Bill Hassell — Mon, 22 Dec 2003 20:54:33 GMT

To limit all root logins to the real system console, just do this:

echo console > /etc/securetty

There are no other controls for console logins for other users.

Re: how can i limit some users only login in console

Varghese Mathew — Mon, 22 Dec 2003 21:03:51 GMT

hi,

If you could use the script it should look like this (it should be a portion in the ".profile" for each users' home directory)...

The users who needs to have access to the system using "su" should be specified in the file "/etc/root.allow"
----------------------------
user=`logname`;
sulog="/var/adm/sulog"
TTY="`tty | cut -d/ -f3`"

if [ ${user} = "root" ]
then

if [ ${TTY} != "console" ]
then
echo ":root login allowed only through console..."
exit
fi
else
grep ${user} /etc/root.allow > /dev/null 2>&1

if [ ${?} -ne 0 ]
then
echo " : ${user} is NOT ALLOWED TO LOGIN AS root"
date=`date "+%m/%d %H:%M"`
echo "ERR ${date} - ${TTY} ${user}-root" >> ${sulog}
exit
fi
fi
--------------------------------------------

Cheers!!!
Mathew.

Re: how can i limit some users only login in console

郑刚_1 — Mon, 22 Dec 2003 21:17:49 GMT

thank you
I do it. edit the /etc/profile
and I want to know more about how to use
/etc/usertty

Re: how can i limit some users only login in console

Bruno Ganino — Tue, 23 Dec 2003 04:05:54 GMT

Hi, é å
more info for usertty (man in attachment)

HTH

Re: how can i limit some users only login in console

Bill Hassell — Tue, 23 Dec 2003 07:58:32 GMT

/etc/usertty is not documented in any HP-UX manuals and according to the man page attached in the previous message, it does not apply to logins authenticated by PAM. Starting with 11.00 and completed in 11.11, all authentication is accomplished through PAM modules. The above man page appears to be from another version of Unix. You'll have to use the /etc/profile method to control user access.

Re: how can i limit some users only login in console

Cheryl Griffin — Tue, 23 Dec 2003 09:33:47 GMT

Happy Birthday Bill!

Re: how can i limit some users only login in console

Bruno Ganino — Wed, 31 Dec 2003 06:49:29 GMT

Do you solved your problem ?

If you want to assign points rad here
http://forums1.itrc.hp.com/service/forums/helptips.do?#28

Happy Holidays
Bruno