How can I prevent user to login directly to a generic account?

[Joachim Weber_1]

Hi,

I'm trying to secure access to a non-root generic user. Users should only be able to su to this generic user from their user specific logins. A direct login should not be possible.

Maybe someone knows a solution.


Thanks in advance,

Joachim

[Cheryl Griffin · Accepted solution]

See KBRC00003707 in the ITRC Knowledge Base.
http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000067342908

Europe:
http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000067342908

[Robert-Jan Goossens]

Hi Joachim,

Check this thread.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=143659

HTH,
Robert-Jan

[Sanjay Kumar Suri]

If you are using CDE you can add the following kind of code in /etc/dt/config/Xstartp file and save.

if [ "$USER" = "root" ]; then
if [ -f /etc/securetty ]; then
if [ "$DTXSERVERLOCATION" != "local" ]; then
grep -q console /etc/securetty
if [ `echo $?` -eq 0 ]; then
exit 1
fi
fi
fi
fi

sks

[Joachim Weber_1]

Hi,

Cheryl, that was so quick and the link really did it. Thanks very much!!

Robert-Jan, a bit more complicated but surely an option.

Sanjay, a good way to secure root.

Thanks to all of you for the quick response!!!!

Regards,

Joachim

[Mark Grant]

I was going to post this but thought it a bit silly. However, HP seem to suggest you do something silly too :)

How about this in the .profile, it's a bit shorter

[ $0 != "-su" ] && exit

[Joachim Weber_1]

Hi Mark,

That seems to be as short as it can get :)

Great idea!!!

Thanks,

Joachim

[Paul F. Carlson]

I'm a couple days late on a reponse here, but have you thought of using sudo?

Change the password on the account to an unknown value to the user, then require them to use sudo to su to that account.