How to allow user login only one time.

[Kennethyap]

Dear Expert,
I have many user login to server but how to dis-allow user login many time?
Any security require to setup ?

[Yogeeraj_1 · Accepted solution]

hi,

this is possible! below a quote from "man login"


Refer to the /etc/default/security file in the security(4) man page for detailed information on configurable parameters that affect the behavior of this command. Currently supported parameters are:

ABORT_LOGIN_ON_MISSING_HOMEDIR

NOLOGIN

NUMBER_OF_LOGINS_ALLOWED


hope this helps!
regards
yogeeraj

[Muthukumar_5]

You can use /etc/default/security by configuring, NUMBER_OF_LOGINS_ALLOWED parameter.

Else, with /etc/profile file as,

if [[ $(users | grep $LOGNAME|wc -w) -gt 2 ]]
then
echo "User name $LOGNAME is having more sessions. Try later"
sleep 2
exit 1
fi
hth.

[Cem Tugrul]

Kennethyap,

i sometimes use Muthukumar's way and
believe me it always works...

Good Luck,

[doug hosking]

Patch PHCO_27694 or equivalent may be required for correct behavior if you use the /etc/default/security method.

[Vibhor Kumar Agarwal]

Just write a small script and initiate it in the .profile of users you don't want to log in again.

In this script you initiate a small command after 1 min of login which writes a "exit" at the end of .profile

So once they have logged in, they won't be able to log in again.

Something like:
echo exit >> $HOME/.profile

[Borislav Perkov]

Hi,
You can put this line at the end of .profile in home directory.

[[ `who | grep | wc -l ` -gt 1 ]] && exit

for the you want to restrict
Regards

[doug hosking]

[[ `who | grep | wc -l ` -gt 1 ]] && exit

is unlikely to be reliable. Suppose I'm grepping for root and there are users named shroot, root37, etc. logged in. How would this affect the results of the grep and wc commands?

This is perhaps a relatively harmless example of some potentially deadly problems with unanchored greps.

I remember years ago a junior operator tried to impress his boss by writing a shell script that tried to be equivalent to the HP-UX 'userdel' command. It took the argument (a user name) as the name of the account to delete, looked for the home directory of that user, and clobbered the home directory before removing the relevant line from /etc/passwd. At least that was the way the script was supposed to work.

The operator carefully tested the script under all of the conditions he could think of. He worked very hard on it whenever he had a few minutes before changing backup tapes.

Weeks passed. He was almost ready to show the boss to try to impress him, but decided to do one more test to make sure his code was perfect... The final test:

# rmuser hi

OK, what's in /etc/passwd that matches 'hi' ?

root::0:3:The devil himself:/:/sbin/sh
hi::12:35:A test user:/home/hi:/usr/bin/ksh

Oh, 'hi' matches the first part of 'himself' so I'll just cd to / and rm -rf it. Oops! That's not what I meant!!!

Needless to say, the operator did not get the promotion he was hoping for, and learned a very valuable lesson about anchored searches in grep!

[Biswajit Tripathy]

Kennethyap,
I would fully agree with Doug Hosking's
suggestion. While using grep, be very
careful.

Note also that the $HOME/.profile is owned by
the user, so nothing stops him/her from
deleting the lines you just added. Putting
the script in /etc/profile is also open to
abuse as the user can use "Ctrl+|" to stop
execution of /etc/profile (as one of the
above post suggests "sleep 2" in the script
before exit, it would be even easier to
terminate /etc/profile and negate what you
are trying to achieve.

The correct way is to use /etc/default/security file as suggested by
many above.

- Biswajit