topic Re: logon by userid instead and su to application in Operating System - HP-UX

logon by userid instead and su to application

dgizaw — Mon, 21 Aug 2006 11:03:06 GMT

Hi every body,

How do I disable user from logging directly by application userid? I want the user to login as him/her self and su to application. If somthing happens I will be able to trace who logged in at that time.

Thanks

Re: logon by userid instead and su to application

spex — Mon, 21 Aug 2006 11:11:07 GMT

Hi,

Take a look at this thread:

http://forums1.itrc.hp.com/service/forums/bizsupport/questionanswer.do?threadId=1048593

PCS

Re: logon by userid instead and su to application

Jonathan Fife — Mon, 21 Aug 2006 11:18:24 GMT

If you have sudo installed I'd disable the account by putting a * in the password field in /etc/passwd, adding all the application users to an appusers group, and then modifying the sudoers file:

%appusers localhost=/usr/bin/su -

Re: logon by userid instead and su to application

Rick Garland — Mon, 21 Aug 2006 11:20:21 GMT

sudo is teh choice.

Allows you to capture the logging asd to who did the su to the account.

Re: logon by userid instead and su to application

Tim Nelson — Mon, 21 Aug 2006 11:33:01 GMT

This has a hole in it but could be an option.

In the profile of the su'd user check that the the number of processes using ps is greater than two. i.e. must have two shells running. If not do an exit.

Now the user could change the .profile after su'ing so this is not a secure option.

Setting the users shell to /usr/bin/false might work but typically you want a shell and the profile to be read when doing su - user.

I have always looked for this option as well, if you find a secure solution make sure you repost.

The only other choice so far would be to use sudo.

Re: logon by userid instead and su to application

dgizaw — Mon, 21 Aug 2006 12:04:06 GMT

Thank you guys for the quick responses. I was wondering if there is anything similar in HP-UX as Solaris /etc/udeny. In /etc/udeny you list the application userid and that will disable any body to directly to login but only able to su. Your suggestions are a little complex, if that is the only choice I might have to use it.

Thank you all

Re: logon by userid instead and su to application

Sp4admin — Mon, 21 Aug 2006 12:30:34 GMT

Hello,

As stated above the SShd2_config file has a deny user line. But what about the /etc/limilogins file. you may want to check and make an entry in that file also.

Sp,

Re: logon by userid instead and su to application

dgizaw — Mon, 21 Aug 2006 14:00:08 GMT

Sp,
The version of OpenSSH I have is 3.7 and SShd2_config does not exits. I checked ssh_config and sshd_config for deny user line and is not there. Can I put a line?

Thanks

Re: logon by userid instead and su to application

Steven E. Protter — Mon, 21 Aug 2006 14:03:59 GMT

Shalom,

This is simple.

Users have no business having the password for the application user.

Change it and don't tell the user.

This is a policy issue, not an admin issue. If you disable the login, root won't be able to su -c username command to start the application server process.

SEP

Re: logon by userid instead and su to application

dgizaw — Mon, 21 Aug 2006 15:02:59 GMT

SEP,
If they do not know the password how can they su to the application user. Here is the example I want to do.
application userid : asap
username: kevin

First Kevin should login as kevin and su to asap to get to the application. Right now a lot of people login as asap and want to know who that person is. If they try to login as asap to the system, the system should not let them login.

Thanks

Re: logon by userid instead and su to application

KapilRaj — Mon, 21 Aug 2006 17:17:12 GMT

I think the ssh way is the best.

OR ..

In the .profile ,

if [ `whoami` -eq "asap" ]
then
exit 0
fi

Change the ownership of .profile to root ( can u change the home owner as root as well and then create all the child directories owned by the "asap" user ?).

I think this will work, user's may have to use "su" instead of "su -" so that profile is not processed.

Test it ...

Kaps

Re: logon by userid instead and su to application

Rick Garland — Tue, 22 Aug 2006 09:03:31 GMT

In HPUX 11.23 there is RBAC. Role Based Access Control.

This will allow you to fine tune some of the access restrictions.

Re: logon by userid instead and su to application

dgizaw — Tue, 22 Aug 2006 17:53:49 GMT

Thank you all for the response. I did the easier one to create a new .profile with exit 0 and tell the users to do as Kapil Raj
suggested. It is working.

Thanks