diasbling a generic functional account from logging in directly

[Paddy O'Connell]

Hi everyone,

I'm looking for a little help with stopping a generic account logging into 1 of our UNIX servers.

I would like the users to login with their own account and then su to this account.

The account in question needs to have it's full permission other than logging in directly, because there's cron jobs and ftp jobs associated with this account

What I tried so far was adding the below to the /etc/profile, while this works for stopping direct logins it also stops su logins to this account as well which i don't want

uid=$(whoami)

if
[ "$uid" = cpsbatch ]
then
echo "Sorry user account $uid is prohibited from logging in directly to $HOSTNAME"
sleep 5
exit 0
fi

Thanks
Paddy

[Gordon Morrison · Accepted solution]

Hi Paddy,
"whoami" returns just the username of the current shell.
If you use "who am i" it will return the original login name of the original login as the first feild on the line, but even after using su, it still returns the username you originally logged in as.

[RAC_1]

Do you have HP ssh installed?? It has built in tcp wrappers. If not install tcp wrappers and prepare /etc/hosts.allow and /etc/hosts.deny files. In /etc/hosts.deny file put following.

telnetd : user_name_to_be_prohibited_from_direct_login

Anil

[Dani Seely]

Hi Paddy,
Try changing the user's shell to /sbin/false. This will allow the user account to login in via ftp but not directly, and may work the same for what you are looking for.

[Gordon Morrison]

uid=$(who am i|awk '{print $1}')

[Paddy O'Connell]

Gordan thank you very much, that is what i was looking for, implemented in test and it works exactly the way i'd hope.

Thanks All for the other replies as well.

Kind regards
Paddy

[TwoProc]

Paddy,

Don't forget to assign points too!