Letting only one instance of a user logging in to a machine

[Vincent Farrugia]

Hello,

In HPUX, can you restrict a user to login only once? For example, the user "foo" can only login once in a certain machine. I.e., whenever you issue the who command, foo can only appear once, not more.

Thanks,
Vince

[Elmar P. Kolkman · Accepted solution]

You could do it by using a special login-shell that does this, or if you trust the user a bit more, it can be done from the .profile or /etc/profile: kick the user if there are 2 (or more) entries in who with the following:

if [ $(who | grep "^`whoami` ") -gt 1 ]
then
echo "Sorry, but you're already logged in"
exit
fi

Mind the space between the back-quote and the double quote... It ensures that small differences between usernames are not mistreated. For instance test3 shouldn't be kicked if only test is logged in. The same for the leading carrot.

To do it using a login shell is trickier, since it should be a binary file.

[Mark Grant]

I don't think there is a specific utility but it is quite easy to achieve yourself.

In the .profile just count login shells for the user "-ksh" using "ps" or directly read utmp or use "last" and just exit if there are more than you want.

[Vincent Farrugia]

Elmar,

I cannot get your script to work. In scripting I am rubbish. Didn't understand regarding spaces and stuff.

Can you please rephrase? :-)

Thanks,
Vince

[Elmar P. Kolkman]

What I mean is that the argument for grep needs some extra characters, apart from the output from whoami.

It should be: grep whoami

(^) at the beginning of a string meand the start of the line

Are there any errors or things like that you get from my 'script' (which is only a part of a script and needs to be added to a .profile or /etc/profile to work) that could help solve the problem?

[Vincent Farrugia]

Hello,

I got to work by adding wc -l like this:

if [ $(who | grep foo | wc -l) -gt 1 ]
then
echo "bla bla"
fi

Thanks, case closed.

Vince

[Elmar P. Kolkman]

You are right. Problem with copying scripts by hand from an X-terminal to MS desktop... Totally missed the wc -l

Glad it works.

[Mark Grant]

I think you might need a count in there such as "wc -l" at the end of the "whoami" bit.

Also, note that this won't stop people logging in as someone else and doing an su but you can't have everything :)

[Vincent Farrugia]

Thanks, actually I'm surprised I managed to get to the wc -l myself. I didn't do scripting since more than a year. Good to surprise yourself every once in a while hehe.

Case closed

[Darren Prior]

Hi Vince,

I know you've marked this question as closed, but I thought you might be interested to know that HP-UX does have that functionality without having to add extra scripts.

The NUMBER_OF_LOGINS_ALLOWED parameter in /etc/default/security defines the number of logins for non-root users. It's available at 11.00 (providing you have PHCO_27004 - login patch [which also requires PHCO_25976]), and at 11i. The security(4) man page is available on 11i systems, or at http://docs.hp.com

regards,

Darren.

[RolandH]

@ Darren,

must the system be a trusted system that this will work or does this work with a normal system, too??

THX
Roland

[Pete Randall]

Roland,

No, it doesn't have to be trusted. Do a man on security. The man page may not be up to date with all the latest features, but it will get you started.


Pete

[RAC_1]

Roland,

It will work irrespective of that.

[RolandH]

THX Guys !!! =|;-]

[Todd McDaniel_1]

my company uses this method for identifying additional logins to warn but not to deny...

you can modify this to kill hte new login... by grepping for the process for the telnet session.

MY_TTY=`tty | cut -f3- -d'/'`
USERS=`finger -fim ${LOGNAME} | grep -v "${MY_TTY}"`
case "${USERS}" in
${LOGNAME}*"Not Logged In"|"") ;;
*) TIME=`date '+%T'`
for TTY in `cut -c12-19 << EOF
${USERS}
EOF
`
do
test -w /dev/${TTY} && echo "SECURITY WARNING!!^G^G Another user
is
logging on to ${LOGNAME} at ${TIME}" > /dev/${TTY}
done
echo "*********************************************************"
echo "* SECURITY WARNING!!^G^G ${LOGNAME} already logged on! IDLE *"
sed -e 's/^/* /' -e 's/$/ */' << EOF
${USERS}
EOF
echo "*********************************************************"
esac