disable certain user login but allow su -

[Steve Blackwell]

I very quick easy question I hope.

On a HP-UX 11.11 system that uses a tcb database is it possible to stop certain users from logging in interactively but allowing su access to them.

I know I could do something with their .profile, but I was wondering if it is possible to do this with a setting in the /etc/passwd file or in the tcb database?

[Enrico P.]

Hi,
you can try to put a * simbol in the password field in the /etc/passwd file.

Enrico

[Enrico P.]

Hi,
you can try to put a * simbol in the password field in the /etc/passwd file.

Remember to save you passwd file first

Enrico

[Steve Blackwell]

Because the system is trusted the * in the /etc/passwd file already exists.

Is there a setting for the tcb database?

Steve

[Rick Garland]

As a trusted system, you will want the /tcb/files/auth directory area. From this point the subdirectory would match the 1st letter of the account name.
Example, for the root account, /tcb/files/auth/r (root starts with the letter 'r' so proceed down this subdirectory)

Put a star in the passwd field in here and you will lock the account.

HPUX does not really have Role Based Access Control (RBAC) until version 11.23.

There are numerous previous posts concerning this subject.

[Rick Garland]

In rethinking, the better option would be to use the modprpw command to lock the accounts. No need to fool around in the tcb database by yourself. Let the command do it for you.

[A. Clay Stephenson]

However, you should note that if you lock the account either by entering an impossible passwd hash (e.g. '*') or by explicitly locking the account via passwd -l or modprpw the only a superuser will be able to su to that account; all other users will be prompted for a password or told that the account is locked.

[Bill Thorsteinson]

Lock the password as noted above and use
the sudo package to su to the account.
The password prompted for by sudo is the account executing the su command not the
target account. su will be done as system
and will not require an active password.

[Steve Blackwell]

You have all confirmed my thoughts.

Cheers

Steve