How to disable direct login access to some users on HP-UX 11i v2

[GSK_2]

Hi Guys,

How to disable direct login access to some users on HP-UX 11i v2? Is there any file in which the user entries can be added?

[Rajeev Shukla]

You can deny users to login from a particular IP address or range using inetd.sec file.
You can not restrict telnet using userid but yes you can restrict ftp

[Peter Nikitka]

Hi,

you can give them /usr/bin/false as login shell or disable the password; scripting in /etc/profile is another way.
The method depends on what these users are allowed to do.

mfG Peter

[wip]

either of the following

1. make user shell to /dev/false
2. Put an "exit" in users .profile
3. Deactivate the account

-wip

[Steven E. Protter]

Shalom,

Take away their user accounts.

You will need a strict office policy that prevents user id sharing.

SEP

[GSK_2]

Hello Guys,

We have an application which runs through appl user But the support guys have to login with their user id's(unique) and then su to that appl user and have to do the support work. We have to restrict direct user access to appl user only. By changing the user shell to /usr/bin/false i am unable to su to that appl user (infact it is logging in and logging out at the same time).

Regards,
Satish

[Peter Nikitka · Accepted solution]

Hi,

for the application login I suggest to setup that id with an invalid password entry but create ssh-keys for these users and put them to
~applusr/.ssh/authorized_keys

So they will be able to switch to that user via ssh only without the need of a password but a normal login to that userid will not be possible:
ssh appluser@hostname

Next I would change the loginshell of that appluser (preferred) to the application program or do some scripting in ~/.profile so that there is a direct start of the application at login time.

mfG Peter