topic RSA Security/sdshell problems in Operating System - HP-UX

RSA Security/sdshell problems

Scott Edwards_6 — Wed, 02 Feb 2005 15:00:23 GMT

We have implimented use of RSA security on our 11.11 system. To do so the RSA shell sdshell is loaded at login in the passwd file. Everything is fine until the users starts Robelle's suprtool and opens and Oracle database instance which then prompts for the RSA passcode again. Can anyone tell me how to reset the default shell after the sdshell has executed at login so we are not prompted again for the passcode when anther shell is spawned?

Re: RSA Security/sdshell problems

Steven E. Protter — Wed, 02 Feb 2005 15:09:57 GMT

Oracle is not certified on that shell.

Is certified for ksh korn shell or posix.

The oracle user id needs a regular shell I think.

SEP

Re: RSA Security/sdshell problems

Scott Edwards_6 — Thu, 03 Feb 2005 10:36:59 GMT

This seems to be true. My question then would be how to change the shell after logon. This has to be done so that the shell is changed in the /etc/passwd file after logon using "chsh $LOGNAME /usr/bin/sh" but then it needs to be returned to the RSA shell "/opt/ace/prog/sdshell" upon logout. It can not be left to the user to do this or they will bypass logging on through the RSA/ACE server the next time the login. Thanks for the help!

Re: RSA Security/sdshell problems

Steven E. Protter — Thu, 03 Feb 2005 10:50:24 GMT

At the command prompt:

/usr/bin/ksh

That changes you to the Korn shell.

Scripting, especially the oracle startup scripts needs to specify the shell.

#!/sbin/sh

Posix shell.

SEP

Re: RSA Security/sdshell problems

Denver Osborn — Thu, 03 Feb 2005 10:59:02 GMT

It would be possible to set oracle's shell to /bin/sh and still use SecurID auth for the initial login if you use a patched build of OpenSSH.

There are patches avail for OpenSSH that add SecurID support. Here's a url w/ the patches for more info. If you need steps on how to compile, let me know. I'd be happy to share my experience w/ building and using OpenSSH with SecurID support.

http://sweb.cz/v_t_m/

-denver