how can i limit some users only login in console

[郑刚_1]

i want to limit some user only login in console and can su to them.
or maybe can deny these users direct login but can su to them

[Michael Tully]

You will need to place a restriction either in the /etc/profile file or the users account .profile ($HOME/.profile) below is an example posting which has some options you can use as a guide.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=274006

[Alan Turner]

You can stop them loggin in by defining their shell to be /usr/bin/false.

You could also use SAM to deactivate the user - this would prevent their being able to login, but would also disable their password, so if you wanted to su to the user, you would first have to gain root privilege.

[Bruno Ganino]

The file /etc/usertty specifies additional access restrictions for specific users.
(not applicable to login implementations that use PAM)
If this file does not exist, no additional access restrictions are imposed.
The file consists of a sequence of sections.
There are three possible section types: CLASSES, GROUPS and USERS.
I think that the USERS-SECTION can to be useful,.

See into your manual for explanations.

HTH
Bruno

[Abskhan]

1]Put a check in the /etc/profile and find out from which IP and the userid the user is logging in and allow accrodingly.
2]if you want to deny direct console login then user /etc/securetty file.
3]Write a small script checking which users u want to allow to do su or use program like sudo which can be downloaded.

[郑刚_1]

please give me more info for /etc/usertty

[Bill Hassell]

To limit all root logins to the real system console, just do this:

echo console > /etc/securetty

There are no other controls for console logins for other users.

[Varghese Mathew]

hi,

If you could use the script it should look like this (it should be a portion in the ".profile" for each users' home directory)...

The users who needs to have access to the system using "su" should be specified in the file "/etc/root.allow"
----------------------------
user=`logname`;
sulog="/var/adm/sulog"
TTY="`tty | cut -d/ -f3`"

if [ ${user} = "root" ]
then

if [ ${TTY} != "console" ]
then
echo ":root login allowed only through console..."
exit
fi
else
grep ${user} /etc/root.allow > /dev/null 2>&1

if [ ${?} -ne 0 ]
then
echo " : ${user} is NOT ALLOWED TO LOGIN AS root"
date=`date "+%m/%d %H:%M"`
echo "ERR ${date} - ${TTY} ${user}-root" >> ${sulog}
exit
fi
fi
--------------------------------------------

Cheers!!!
Mathew.

[郑刚_1]

thank you
I do it. edit the /etc/profile
and I want to know more about how to use
/etc/usertty

[Bruno Ganino]

Hi, é å
more info for usertty (man in attachment)

HTH

[Bill Hassell]

/etc/usertty is not documented in any HP-UX manuals and according to the man page attached in the previous message, it does not apply to logins authenticated by PAM. Starting with 11.00 and completed in 11.11, all authentication is accomplished through PAM modules. The above man page appears to be from another version of Unix. You'll have to use the /etc/profile method to control user access.

[Cheryl Griffin]

Happy Birthday Bill!

[Bruno Ganino]

Do you solved your problem ?

If you want to assign points rad here
http://forums1.itrc.hp.com/service/forums/helptips.do?#28

Happy Holidays
Bruno