topic Re: Security in Operating System - HP-UX

Security

Tim D Fulford — Fri, 23 Feb 2001 10:43:16 GMT

I know about /etc/securetty restricting root's login ttys/console, however is there a similar file for each user? I have some common application logins which are quite powerful (database, application etc). I would like to force users to login as themselves then su to the appliaction login i.e.
login: joe_blog
Password: ********
% su - informix
....
This should allow me to find out what users(people, not apps) did what!
Cheers

Re: Security

Ralf Bosz_2 — Fri, 23 Feb 2001 11:12:57 GMT

But this at the end of the user .profile (or in the /etc/profile):

if [ $rechtstreeks = user ];then
echo "Access Denied, use su - user"
exec sleep 5
exit
fi

Oh and just a reminder, user search next time, I got this from a search (I thought of something likewise but didn't use logname)

Re: Security

Ralf Bosz_2 — Fri, 23 Feb 2001 11:15:33 GMT

Seem to forget a line which goes above the others ;)

rechtstreeks=`/usr/bin/logname`

(p.s. rechtstreeks is a Dutch word voor "straight" so you can make-up your own variable here)

Re: Security

Jon Gittoes — Mon, 26 Feb 2001 05:01:51 GMT

Is this the only method of resticting login? I'm used to AIX, where you can set login=no and rlogin=no, surely there must be a better equivalent than putting something in the .profile?

Thanks

Jon. ( I have the same requirement as the original poster)

Re: Security

Patrick Wallek — Mon, 26 Feb 2001 05:11:42 GMT

The way we have done this is to use sudo and to set the password of the appropriate account as an invalid password (like a *). We then set up a script (or alias) for the users so that when they type oracle, it does a 'sudo su - oracle' and then asks for their password. Also via sudo you can control who does and does not have access to the script.

Doing this also makes sure that no one logs in directly as the application id, but forces you to do an su.

Re: Security

Tim D Fulford — Mon, 18 Jun 2001 15:32:53 GMT

Many Thanks for the replies

It took me a while to clear this one up! sorry, I'm using Ralf's method. It is not what we want exactly but it has similar functionality.

Sudo is a definite contender for the future, but one step at a time

Again many thanks all

Tim F