When an oracle user logsin via a dt, hp or a xt session toast 'em

[Bob Milton]

When an oracle user logs in via a dt, hp or a xt session I want to toast 'em. I have 11 Oracle dba's and most of them will login as their account then su oracle (no - ) as I have in the oracle home account .profile exit 0. But they have discovered they can use a GUI such as Exceed to do a dtsession which doesn't read or use the oracle .profile... I have a HP solution to edit Xstartup and so on which will be null on a OS upgrade. Any suggestions would be appreciated so I can run a simple script that will allow someone to su to oracle but not login as oracle. Thanks.

[Victor BERRIDGE]

Hi,
Just thoughts, what about removing the shell or put something else as, in /etc/passwd, that would stop them connecting or do a su - oracle, then move .profile to profile_oracle and foorce them to su oracle (to get UID) then . profile_oracle to get the env ?

Im having trouble with my SP2 I have to leave

Best regards
Victor

[Pramod_4]

Hi,

Add the following in your /etc/profile:

if [ "$LOGNAME" = "oracle" ]
then
exit 1
fi


Ensure that you don?t make any typographical errors.

With the above in /etc/profile ?su ? oracle?, hpterm and xterm exits but ? su oracle ? works perfectly.

Protect your /etc/profile with proper permissions.!!


Regards,

Pramod

[Karen Elrod]

You could also edit the .dtprofile and uncomment the DTSOURCEPROFILE=true so that the profile is always read.

[Alex Glennie]

This is what you want =>

check /usr/dt/config/Xaccess : this file can be used to prevent access from specific remote hosts eg your friends on the PC's. It will affect only users who login via or under an X or CDE session.

As to why they can by pass your security via CDE login : most likely reason is the shell is not reading the users .profile.

This too can be ammended : check man dt,xt or hpterm : see loginShell resoure : you can set in each users $HOME/.dt/.Xdefaults file or globally.

To check this theory : get a users to login as normal via exceed : run dterm -ls & and then try Oracle, if this method fails ...this is your problem

[Alex Glennie]

you can also use a similar method to Pramod to prevent a specific user login via CDE ... I can give you details, but a search on this forum should also uncover the details.