topic Re: Prevent users from Logging in Operating System - HP-UX

Prevent users from Logging

brian_31 — Thu, 11 Nov 2004 20:19:55 GMT

Team:

What is the best way to prevent the users from logging while i want the root to login. I can't go to single user mode.

Thanks

Brian

Re: Prevent users from Logging

Sridhar Bhaskarla — Thu, 11 Nov 2004 20:34:40 GMT

Hi Brian,

Quite a few ways... The one I would prefer is to through inetd.sec file.

#cp /etc/inetd.sec /etc/inetd.sec.good
#vi /etc/inetd.sec

Add lines like

telnet allow ip_of_your_workstation
ftp allow ip_of_your_workstation
login allow ip_of_your_workstation
exec allow ip_of_your_workstation
shell allow ip_of_your_workstation

Run 'inetd -c'.

If you are running sshd, stop the daemon. Stop dtlogin process (/sbin/init.d/dtlogin stop).

Once you are done with your work, move the old inetd.sec back and run 'inetd -c' again to get it going. Start dtlogin and sshd processes.

-Sri

Re: Prevent users from Logging

Ermin Borovac — Thu, 11 Nov 2004 20:52:51 GMT

Another way is to use NOLOGIN feature in /etc/default/security file. See security(4) for more information.

o Add NOLOGIN=1 to /etc/default/security file.
o Create /etc/nologin with the message you'd like your users to see.
o Stop dtlogin.

ssh should also check for existance of /etc/nologin file so there is no need to stop sshd.

Re: Prevent users from Logging

brian_31 — Thu, 11 Nov 2004 21:45:25 GMT

Team:

/etc/default/security file can be used in trudted systems only right. Ours is not trusted. is there any other way?

Thanks

Brian

Re: Prevent users from Logging

Ermin Borovac — Thu, 11 Nov 2004 21:56:03 GMT

As far as I know you don't need trusted system to use /etc/default/security. Although some of its parameters cannot be used on untrusted system (e.g. PASSWORD_HISTORY_DEPTH).

Re: Prevent users from Logging

brian_31 — Thu, 11 Nov 2004 22:02:21 GMT

you are right. i tried and it works. i also tried the inetd.sec file (there was no such file and i had to create one but still i am able to login after making the entries and running inetd -c). aslo is there any other way?

Thanks

Brian

Re: Prevent users from Logging

Ranjith_5 — Thu, 11 Nov 2004 22:39:59 GMT

Simple Method:

Hi Brian,

Easiest and Safest way is :

#>/etc/nologin OR
#touch /etc/nologin

After this kill all the users currently logged in to the system.They wont be able to login further.

See http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=147806
Regards,
Syam

Re: Prevent users from Logging

Ranjith_5 — Thu, 11 Nov 2004 22:40:48 GMT

Hi Brian,

Easiest and Safest way is :

#>/etc/nologin OR
#touch /etc/nologin

After this kill all the users currently logged in to the system.They wont be able to login further.

Regards,
Syam

Re: Prevent users from Logging

Ranjith_5 — Thu, 11 Nov 2004 22:42:22 GMT

Oooooooooooooooops I clicked twice when I found error in posting reply and it came twice. i am sorry