Restricting user to login after there shift

[Syed Furquan Alam]

Hi,

I have a hp-ux machine and there are 5different groups of users. Now we want to restrict one group of user from login once there shift is over. So it means only 2 group will be able to login at a particular time one is whose shift is there and other one is 24hrs group and rest 3 groups user can't login. Similarly for other groups also for other part of the day.

Plz let me know if we can restrict like this any how. 

Best regards

syed

[Johnson Punniyalingam]

Yes its possible.. what is your hpux  os version ..?

[Syed Furquan Alam]

Hi Johnson,

It is HP-UX 11.31 64bit.

[Johnson Punniyalingam]

man security or you can use smh to configure

Configure Per User Exceptions by entering valid user values as specified in security(4) man page. Enter <default> to remove a per user value. The per user value for the security attributes PASSWORD_MINDAYS, PASSWORD_MAXDAYS and PASSWORD_WARNDAYS cannot be removed individually.

Example :- 

/usr/sbin/userdbset -u shift1 LOGIN_TIMES=Mon

shift1 -> user account name

Login_time = Mon .. user can only login on Monday

[Johnson Punniyalingam]

sorry correction on Login Time filed

[Johnson Punniyalingam]

/usr/sbin/userdbset -u shift1 LOGIN_TIMES=Su

Shift1 -> user account , Login_Times=Su -> user can login only on sunday

[Johnson Punniyalingam]

below will be the output

Trying...Connected to testserver

.Escape character is '^]'.

Local flow control onTelnet TERMINAL-SPEED option ON
HP-UX test server B.11.31 U ia64 (ta)
login: shift1

Password:

Access is denied by the LOGIN_TIMES attribute in security(4).

Connection closed by foreign host.

[Dennis Handly]

If you need to restrict logins during certain hours of the day, you could put the logic into each user's .profile.  If they are smart enough to defeat that, you would have to put it into /etc/profile.

[Syed Furquan Alam]

Hi Dennis,

Thnx for your reply, but can u plz let me know the full step how to put the logics in the .profile of each user as well as on /etc/profile.

Plz expplain the full steps.

Thnx in Advance

[James R. Ferguson]

---

@syed Furquan Alam wrote:

Thnx for your reply, but can u plz let me know the full step how to put the logics in the .profile of each user as well as on /etc/profile.

---

It would be appropriate to spell correctly; "...u plz..." isn't English, but "...you please..." would be.

That said, you basically want to determine the current date and or time and compare that to the period(s) you want to allow login.  If the user isn't logging in during his/her allowed period, simply exit.  For example, if you only wanted a user to login Monday through Friday and then only between 0800 and 1700, you might add this to your profile:

WDAY=$(date "+%w") # 0-Sunday, 6=Saturday
if [ ${WDAY} -lt 1 -o ${WDAY} -gt 5 ]; then
    echo "Weekend login not allowed"
    exit 1
fi
HOUR=$(date "+%H")
if [ ${HOUR} -lt 8 -o ${HOUR} -gt 16 ]; then
    echo "Invalid login period"
    exit 1
fi

Be advised, that if you choose to do this in '/etc/profile', then you want to make sure that it doesn't apply to the 'root' user --- an exercise left to you.

Regards!

...JRF...