Disable direct login of user from specific source

[Famy]

I have a user "XYZ" on server prod.
There are applications running on prod as XYZ as owner.

I want to disable direct login as user "XYZ" on server prod.

Users should be able to do sudo to this user XYZ once they are logged into the server as their named user.

Now main requirement is direct login should be enable only from one another server "TEST" and not from any other servers or client machines.

[George Spencer_4]

We have similar requirements on our systems (or maybe I should say that our auditors have enforced similar requirements). We only permit administrative logins to be accessed via sudo; not directly. To achieve this you can either: lock the login, or change the encrypted password to an asterisk. Once the user has logged in on their own account, if they thay have been added to the sudoers file, then they can sudo to the administrative account.

Unfortunately for you, this blocks all logins of the administrative accounts from remote hosts.

You can however bypass this problem by using ssh with a public/private key.

[Famy]

I would require to do telnet,ftp from the remote server "TEST" as XYZ user in PROD.

How can I do that ?

Public/Private key only will help for ssh/scp.

How can i do telnet and ftp too.

[D. Jackson_1]

Check into the file /var/adm/inetd.sec.
You can do some IP control through there for telnet sessions and others.

on PROD
ftp deny *.*.*.*
telnet deny *.*.*.*

ftp allow
telnet allow

I would enforce all other users to use SSH and SFTP/SCP for access.

HTH