focring users to su to a specific ID

[denise_7]

I want to be able to force users to log into their personal account first, then su to a specific ID (Developers) to execute scripts. In other words, I don't want the users to log into as Developer first. I know there is some way to set up su, but forgot how. Thanks.

[MANOJ SRIVASTAVA · Accepted solution]

Hi Denise


this is how we do it for root and oracle :


loginid=`who am i | awk '{print $1}'`
echo $loginid
if [ $loginid = oracle ]
then
exit
fi

echo $loginid
if [ $loginid = root ]
then
exit
fi
These lines are to be added in /etc/profile
You can change the id to whatever you want to restrict , then the suer will ahve to su to the the id .


Manoj Srivastava

[Rodney Hills]

You might be able to use group permissions. If you only allow the scripts to be executable by a specific group (say group "developer"), then after the users login, then they could enter "newgrp developer" to become a member of the developer group.

You could even put a password on developer by putting the encrypted password into field 2 of /etc/group. Then all the developers would have to know that password.

This way they can keep their UID number for their terminal session. Using "su", all users would have the same UID.

My 2 cents...

-- Rod Hills

[Jordan Bean]

You can prevent direct login of all users (or primary groups) listed in a special text file by testing the ownership of the assigned tty during login by adding either of these to /etc/profile.

# If you are a restricted user and you own
# the assigned tty, then die.
if grep -Fq $(id -un) /etc/nodirectlogin
then
if [ -O $(tty) ]
then
echo 'Direct login denied.'
exit 1
fi
fi

or

# If you are a member of a restricted group
# and you own the assigned tty, then die.
if grep -Fq $(id -gn) /etc/nodirectlogin
then
if [ -O $(tty) ]
then
echo 'Direct login denied.'
exit 1
fi
fi

[john korterman]

Hi,

for a user called flipflop, you could prevent direct logon by adding this to flipflop's .profile:

if [ `logname` = flipflop ]
then
echo Direct login not allowed for user flipflop
exit
fi


regards,
John K.

[James Ellis_1]

I will have to get back to you on this as I am looking into this myself. I'll let you know what we do and how we solved this. Good luck!

[denise_7]

Manoj and John,

Being out of programming for a while (C++), I had to review some things. But Shell programming is rather simple yet I cannot figure this out. Your two suggestion to put in the /home/userid/.profile does not work. The error I get is:

${HOME:-.}/.profile[28]: [userid=userid]: not found

It looks like its a parameter passing error or something like that. The error of userid=userid seem to not comparing correctly.

Thanks.

[Deshpande Prashant]

HI
Use following to restrict direct login as well as allow only authorized developers (Listed in /etc/oracle.allow file) to "su" to oracle.
####
user=`logname`;
sulog="/var/adm/sulog"
TTY="`tty | cut -d/ -f3`"
date=`date "+%m/%d %H:%M"`

if [ ${user} = "oracle" ]
then
echo " : Direct login Not Allowed..."
echo "ERR ${date} - ${TTY} ${user}-oracle" >> ${sulog}
exit
fi
else
grep ${user} /etc/oracle.allow > /dev/null 2>&1
if [ ${?} -ne 0 ]
then
echo " : ${user} is NOT ALLOWED TO LOGIN AS Oracle"
echo "ERR ${date} - ${TTY} ${user}-oracle" >> ${sulog}
exit
fi
fi

#--
Thanks.
Prashant.

[MANOJ SRIVASTAVA]

Hi denise


This is to be put in /etc/profile and not in $HOME/USER/.profile


so that it runs for all users.


Manoj Srivastava