topic disable certain user login but allow su - in Operating System - HP-UX

disable certain user login but allow su -

Steve Blackwell — Tue, 23 May 2006 08:54:57 GMT

I very quick easy question I hope.

On a HP-UX 11.11 system that uses a tcb database is it possible to stop certain users from logging in interactively but allowing su access to them.

I know I could do something with their .profile, but I was wondering if it is possible to do this with a setting in the /etc/passwd file or in the tcb database?

Re: disable certain user login but allow su -

Enrico P. — Tue, 23 May 2006 09:05:14 GMT

Hi,
you can try to put a * simbol in the password field in the /etc/passwd file.

Enrico

Re: disable certain user login but allow su -

Enrico P. — Tue, 23 May 2006 09:05:49 GMT

Hi,
you can try to put a * simbol in the password field in the /etc/passwd file.

Remember to save you passwd file first

Enrico

Re: disable certain user login but allow su -

Steve Blackwell — Tue, 23 May 2006 09:12:09 GMT

Because the system is trusted the * in the /etc/passwd file already exists.

Is there a setting for the tcb database?

Steve

Re: disable certain user login but allow su -

Rick Garland — Tue, 23 May 2006 09:30:56 GMT

As a trusted system, you will want the /tcb/files/auth directory area. From this point the subdirectory would match the 1st letter of the account name.
Example, for the root account, /tcb/files/auth/r (root starts with the letter 'r' so proceed down this subdirectory)

Put a star in the passwd field in here and you will lock the account.

HPUX does not really have Role Based Access Control (RBAC) until version 11.23.

There are numerous previous posts concerning this subject.

Re: disable certain user login but allow su -

Rick Garland — Tue, 23 May 2006 10:50:33 GMT

In rethinking, the better option would be to use the modprpw command to lock the accounts. No need to fool around in the tcb database by yourself. Let the command do it for you.

Re: disable certain user login but allow su -

A. Clay Stephenson — Tue, 23 May 2006 10:56:26 GMT

However, you should note that if you lock the account either by entering an impossible passwd hash (e.g. '*') or by explicitly locking the account via passwd -l or modprpw the only a superuser will be able to su to that account; all other users will be prompted for a password or told that the account is locked.

Re: disable certain user login but allow su -

Bill Thorsteinson — Tue, 23 May 2006 11:04:50 GMT

Lock the password as noted above and use
the sudo package to su to the account.
The password prompted for by sudo is the account executing the su command not the
target account. su will be done as system
and will not require an active password.

Re: disable certain user login but allow su -

Steve Blackwell — Thu, 25 May 2006 03:42:36 GMT

You have all confirmed my thoughts.

Cheers

Steve