Disable oracle login

[hpuxrox]

How would one disable direct login from to root

[Steven E. Protter]

Shalom,

1) Change the shell in /etc/passwd to /usr/bin/false

2) Change /etc/profile to detect and log out the oracle user.

Suggestion 2 interfers with system startup of the database. System 1 does as well. Don't do either if your system auto starts oracle.

Another method is the use the passwd -l command.

Root should still be able to start the database after running:

passwd -l oracle

SEP

[James R. Ferguson]

Hi:

> How would one disable direct login from to root

If that is the question, then one way is to create '/etc/securetty' with the line:

console

...This will prevent 'root' from logging on anywhere except from the console. This does *not* prevent 'su' to the root account, but that will be tracked in '/var/adm/sulog'.

To impose additional constraints on 'su' setup a 'SU_ROOT_GROUP' in '/etc/default/security'. This option forces a non-superuser to be a member of the specified root group to be allowed to 'su' the root account.

Regards!

...JRF...

[hpuxrox]

I'm looking to do the same thing /etc/securetty does for root.. but for oracle

[hpuxrox]

I will just use DenyUsers in ssh... I was just hoping there was a system level way. thanks

[Geoff Wild]

I believe you can do this with Role Based Access Control:

http://docs.hp.com/en/5991-8678/index.html

Either that, buy Server Control from http://www.foxt.com or I believe Centrify has something as well...

Rgds...Geoff

[Srinivas Thokala_1]

The control files are
/var/adm/.access_list
/var/adm/.secure_console
/var/adm/.generic_login

The account IDs listed in ile .generic_login will restric direct login. One has to login as themself before su to generic accounts.

-Srini