topic Script access control in Operating System - HP-UX

Script access control

Khashru — Wed, 08 Feb 2006 21:01:23 GMT

Hi,

I am creating a script that will be used by help desk person to change password. I want that they can only type p for password change. if they type something else it will echo it and will be in the loop so the user donnot need to login again.

Re: Script access control

Ivan Ferreira — Wed, 08 Feb 2006 22:17:37 GMT

You can use something like this:

getoption() {
echo "Enter p to change a user's password or press q to finish"
read OPTION
}

getoption

while [ $OPTION != "q" ]; do
case $OPTION in
p)
echo "Enter user name"
read USER
passwd $USER
;;
*)
echo $OPTION
;;
esac
getoption
done

Re: Script access control

Khashru — Wed, 08 Feb 2006 22:24:35 GMT

Yes thats ok but i donot want the user to get the shell. ie i donot want him to exit from the program. he can only use p for password change. If he press something else it will again ask him for passwd change for other person.

Re: Script access control

Ivan Ferreira — Thu, 09 Feb 2006 00:06:28 GMT

Edit the user's profile, add the path to the this script in the profile, if the file is called for example /usr/local/sbin/changepwd.sh, add to the user's profile:

# Avoid cancel of the script
stty dsusp undef eof undef eol undef eol2 undef discard undef \
status undef intr undef kill undef lnext undef quit undef reprint undef \
start undef stop undef susp undef werase undef
# Start the script
/usr/local/sbin/changepwd.sh
# Do not allow access to the shell
exit

So, the user won't have access to the shell. When the users logon, the script will start, when he press "q", the exit command will be run and will logout from the system.

Re: Script access control

Khashru — Thu, 09 Feb 2006 01:22:15 GMT

I will try that tomorrow.

Re: Script access control

Muthukumar_5 — Thu, 09 Feb 2006 01:36:48 GMT

However, If we add the script with /etc/profile or $HOME/.profile the user is still allowed to use the signal's as ctrl+c or ctrl+d. Which can not be trapped. Better use the script execution as,

nohup passwdscript

which will trap those signal's too.

--
Muthu