How to Prevent Login to Oracle acct

[Charlie Hoffman]

I have a Oracle DBA that refuses to login using his personal account, as per our standards. He continues to login directly to the oracle account. This prevents tracking user actions as required by SOX.
I am running HPUX 11i. I know I can add a test to the login script but there must be a way to restrict normal logins using somthing similar to what is done with root login.

We want the user to log into the system as themselves then su to oracle.

Is there a way to prevent this user from logging directly into oracle through security or pam?

[Patrick Wallek]

Change the password and don't tell them what it is.

Then install sudo and write a little script that does:

# cat sudo_oracle
#!/usr/bin/sh
sudo su - oracle

Add the users to the sudo configuration and force them to use the above script.

[Ivan Ferreira]

If you don't wan to use sudo, you can add something like this to the /etc/profile:

whoisit="$(who -m | awk '{print $1}')"
if [ "${whoisit}" = "oracle" ]
then
echo "Direct login not possible, logon as your account and use su - oracle"
exit 1
fi

[MANOJ SRIVASTAVA · Accepted solution]

You can do like this

this is how we do it for root and oracle :


loginid=`who am i | awk '{print $1}'`
echo $loginid
if [ $loginid = oracle ]
then
exit
fi

echo $loginid
if [ $loginid = root ]
then
exit
fi
These lines are to be added in /etc/profile
You can change the id to whatever you want to restrict , then the suer will ahve to su to the the id .


or
look at this thread
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=960227

Manoj Srivastava

[Rick Garland]

On 11.23 the RBAC is available.
Role Based Access Control

[JASH_2]

Charlie,

The trouble with adding anything into the .profile of a user, even oracle and root, is that once the user has finally su - to the "super user" then they can just change the .profile back to how it was. You may never notice!

May well be worth thinking about sudo.

Just a thought.

JASH

[Charlie Hoffman]

I thought the same thing. I hope that someone can explain how PAM can be used in this situation.

[Charlie Hoffman]

There does not seem to be a good solution for this issue other than use of a third party program. Thanks for the help.