Disable Remote Login

[Douglas Trainor]

Disabling root is done with the /etc/securetty file.
How do I disable other user accounts, like oracle, similarly?
The idea is to have a user login as themself, then su to the oracle account.

Additionally, I would like to ALLOW the same remotely disabled user login
to be able to ftp in. SAM has nothing like AIX's SMIT, which runs "chuser" with
options to do this.(I hate that our admin tools are lacking in comparison to AIX!)
TIA,
DOug
973.781.7413

[Antoanetta Naghiu]

You can try to play with seconday group and permission. Eventually grant users under their name and dba group with oracle user's rights.
Try to get an internal Oracle mechanism that offer you a log about who did what.
At OS level?... good question... You can create .rhosts in Oracle home directory and let login without password just desired users commning from specifical hosts... You'll get everything log in syslog, but this is not a porfessional solution... Sorry..

[CHRIS_ANORUO]

You can disable users through SAM and then include the user names in $HOME/.rhosts of oracle home or /etc/hosts.equiv of the server.

[John Hall]

Put the following code in /etc/profile -- the user cannot break out of that. If the userID is "steve" or "pete" then telnet access will be denied. This code works by looking to see what program the parent is and is not fooled if the string "telnetd" is a substring of the text returned by the "ps" command (eg. /usr/bin/mytelnetd). If the parent program were to be telnetd then this user is trying to login using telnet.

case $LOGNAME in
steve|pete)
PSinfo=`ps -ef | grep $PPID | awk '{if($2==PPID){print}
}' PPID=$PPID`
TAB=`echo "t"`
echo "$PSinfo " | grep "[ |${TAB}|/]telnetd[ |${TAB}]" >> /dev/null
case $? in
0) echo "Login [$LOGNAME] not allowed telnet access."
exit ;;
esac
;;
esac