Allow only SU to a specific user id

[Nellian Solaiappan]

Hi All
Im running informix on HP-UX 11.0 and since the user id informix on this box has maximum rights on the database, I need to disable logging in to the server directly as informix. Instead I need to allow only certain users to login and then su to informix. can this be done?
I will greatly appreciate any help.
Regards
Nell

[john korterman]

Hi,
one way is to put this into the .profile of the informix user:

#!/usr/bin/sh
if [ `logname` = "informix" ]
then
echo "direct login not allowed"
exit
fi

assumed that the informix user reads .profile, of course.
regards,
John K.

[RAC_1]

Above code will work, but has a problem.
Is any user does "su - informix" .profile of informix user will get executed and it will exit. This code will take care of not allowing direct logins and not allowing su - informix too. (su informix will work because .profile of informix will not get executed)

sudo looks your option. Install sudo and configure all those users to get su - informix.
visudo to edit sudoers file.
like

user1 (informix) "sudo - informix"

Also you will have to move the code above to /etc/profile to disallow direct logins.

[john korterman]

Hi again,
The code suggested in my first posting will actually not prevent a logged in user from executing â su â informixâ , assumed that the user´s logname does not expand to â informixâ .
However, RAC's suggestion looks like the better in the long run.

[Mark Nieuwboer · Accepted solution]

Stil this al the above doesn't prevent user login.

put this in /etc/profile
# custom code for denying generic account login
if logname > /dev/null 2>&1
then
LGNM=`logname`
if egrep "^${LGNM}$" /etc/not_loginable > /dev/null 2>&1
then
echo "\nDirect login not allowed for $LGNM\n"
echo "\nNO remote login allowed for $LGNM (`date '+%D %T'`)\n" |
logger -p user.err -t NOT_LOGINABLE
exit 1
fi
fi

create the file /etc/not_loginable
put the user informix in it.

then in /etc/security add the following line
SU_INFORMIX_GROUP=(groupname informix)

put the user which you want that the can su to the user in the group you names it above.

this will work.

grtz. Mark

[john korterman]

Hi again,
The code suggested in my first posting will actually not prevent a logged in user from executing â su â informixâ , assumed that the user´s logname does not expand to â informixâ .
However, RAC's suggestion looks like the better in the long run.

[Nellian Solaiappan]

Thans guys!
Marks solution has worked out best for me. :) Im pretty sure sudo would be a sure shot solution too but for now since I'm not planning to migrate to sudo rightaway, I'm settling for Mark's solution.

Nell