Concurrent Logins and Virus Protection on HP-UX 11.00

[Laurie A. Krumrey]

Hi All,

We have a Trusted System and it's not NIS or
NIS+. It's HP-UX 11.0 and it's a R390.

How do we prevent concurrent logins, users with
the same login logging in more than one time?
We don't want a user ie. joeuser to be active more than one session at a time.

Also is there any virus protection for our
HP-UX? I think this is probably a stupit question on my part since I really believe the
answer is NO but I would like to hear this from
someone else.

We need to make our Web Unix box as secure as
possible with our logins.

Thank you for your help...
Laurie

[Patrick Wallek · Accepted solution]

Last question first - There is no virus protection that I know of for HP-UX. There may be software out there, but I haven't ever seen any.

Now to your first question - There is no way that I know of built into HP-UX to prevent a user from logging in more than one session at a time. Something you could do is add something like the following to /etc/profile to check if the user is already logged in and if so don't let them log in again. Be warned that I am not guaranteeing that the syntax of the following will be exactly correct.

NUM_LOGINS=`who | grep $LOGNAME | wc -l`
if ( NUM_LOGINS >= 1 )
then
echo "You are already logged in once."
echo "No more sessions allowed."
exit
fi

[James R. Ferguson]

Hi Laurie:

The question of viruses has come up a couple of times. I think Bill Hassell addresses it pretty well here;

http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0xe0a2d1e5762fd5118fef0090279cd0f9,00.html

...JRF...

[A. Clay Stephenson]

Hi Laurie,

There is one UNIX based anti-virus suite that I am familiar with. Check out http:\\www.sophos.com. It's main function is to spot PC virus'es in sendmail servers and it does run on HP-UX. In general, the UNIX 'market' is too small and too specialized to attract the bad guys. However, if your UNIX server is serving up files for PC's (Samba, NFS) or is a mail server then loking into a centralized anti-virus program makes sense. I have found that the sophos guys are not as quick about getting new virus signitures and fixes as the PC based products are.

Regards, Clay

[Shannon Petry]

Modifying the /etc/profile is the only way to limit your logins to 1 per user. The example given above works. This may have bad effects on an XDCMP client though! If you use them...

As for Virus' in any UNIX, they simply dont exist. Other than what Bill Hassel mentions in the previous posts URL, there is another very important feature in All Unices which render virii pretty useless. And that is process control.

If jondoe runs a program, it can only damage his files and processes. Since even a command like "rm" can be modified to reak havoc on a Unix box, it would require root access to replace the binary that users would normally use.
This happens, but usually by lazy admin who launch trojans, and not really a virus. Knowing your systems, setting proper paths, and proper rotation and use of passwords, and security patching should nullify trojans!

If there was such a memory resident virus, only that users files and programs could be manipulated. This gives ready access to isolate and find the problem!

Microsofts made yet another half-a$$ implemetation of process control in Win2K, as well as other problems that they stuff down peoples throat. I.E. enabling execution of VB script in everything they sell with no ability to turn it off! Of course the AV distributors love it, cuz everyone that uses MS has to buy one. ISP's love it, cuz they can track you, load software on you without you knowing, etc...and support companies love to sell it to you cuz what a better way of getting repeat business than selling people brand new broken junk!

Unix(HP-UX, Solaris, AIX, IRIX, and even Linux) are made to be a complete package, that works from the get go...Years and years have gone into refining the process controll, networking, file systems, etc...

Regards,
Shannon

[Laurie A. Krumrey]

OK I installed the syntax in /etc/profile and
I get this error:

/etc/profile[131]: NUM_LOGINS: not found.

Also what is a XDCMP client?


Thanks,
Laurie

[Richard Darling]

XDMCP = X Display Manager Control Protocol...
mechanism for an Xterminal to request a session from a remote host...

go ftp://ftp.x.org/pub/R6untarred/xc/doc/hardcopy/XDMCP/xdmcp.PS.Z

for detailed docs...
RD

[Joel Shank]

Laurie

Put the dollar sign ($) in front of the NUM_ variable name in the if statement, NOT where it is assigned a value.

:-) -- jls

[Sachin Patel]

Hi Laurie,
Check in your passwd file for your shell.
If your shell is csh or tcsh then
set NUM?????
if ($NUM???.....) and so.

sachin

[Laurie A. Krumrey]

OK I got it to work so well that it also
prevents root from having more than one login,
which I don't like.

Here's my code from /etc/profile, note I have
bourne shell:

typeset -i NUM_LOGINS
NUM_LOGINS=`who | grep $LOGNAME | wc -l`
if ((NUM_LOGINS > 1))
then
echo "I am sorry. You are already logged in once to the Server."
exit
fi

How to I not apply this to my root login?
I though root just looks at the /.profile
it also seems to execute /etc/profile.

I have tried using the grep -v root and
if (($LOGNAME <> "root")) then... and I
can get it to not work for root, but then it
stops working for all other id's...

Any thoughts on how to change this just for
non-root users???

Laurie

[Patrick Wallek]

How about something like this:

if ( $LOGNAME != root )
then
NUM_LOGINS=`who | grep $LOGNAME | wc -l`
if ( $NUM_LOGINS > 1 )
then
echo "STUFF!!!"
exit
fi
fi

[Laurie A. Krumrey]

I'm been trying all kinds of varitions of that
above and I get this error from root and non
root:

etc/profile[132]: lkrumrey != root: The specified number is not valid for this.

etc/profile[132]: root != root: The specified number is not valid for this.

It seems like I can either have this work for
all logins or none. I can't seem to pull root
out.

[Patrick Wallek]

Laurie,

I just tried the following in my /etc/profile and it works for all ids as long as the shell is /sbin/sh

if [ "$LOGNAME" != "root" ]
then
NUM_LOGINS=`who | grep $LOGNAME | wc -l`
if [ $NUM_LOGINS > 1 ]
then
echo "ALready logged in once"
exit
fi
fi

[Laurie A. Krumrey]

Thank You Patrick you are a genius!

[Shannon Petry]

Just another script methodology which can make shells happier!

I_AM=`whoami`
typeset -i LOGINS
if [ "${I_AM}x" = "x" ] ; then
echo "I DONT KNOW YOU!"
echo "GOOD BYE!"
exit 2
elif [ "${I_AM}" = "root" ] ; then
echo "" >>/dev/null
#FALL THROUGH
else
LOGINS=`who -u|grep ${I_AM}|wc -l`
if [ ${LOGINS} >= 1 ] ; then
echo "You are already logged in!"
echo "Disconnecting"
exit 2
fi
fi

Syntax is kind of a pain in the butt!

Regards,
Shannon

[Stephane Caron]

I am a little nervous with what I have been reading... First, I would strip out all extra junk except the login id's from the output if "who", then search for lines that contain the the full login id string, to prevent unexpected positives. Something like

LOGINS=`who | awk ' { print $1 } ' |grep "^${I_AM}$" |wc -l`

The awk statement isolates the first word (login ID). The "^" and "$" at the beginning and end of the grep string mean "beginning of line" and "end of line" repectively.

This will prevent user "john" from being lockout because "john2" is logged in, or user "pts" being locked out because someone else is logged in on "pts/2", which would be the case with most of the code that has been posted to date...

I have been burnt so many times with the grep command in the past. Beware...