limit logins to members of a specific group

[Rick Garland]

Hi all:

HPUX 11.00 on L2000 hardware.

I seem to be an early case for dementia...

How can I limit logins to a system by group membership? Only those users that are a member of the sysadmin group can login, everybody else is prevented from login to the system.

Many thanks!

[John Poff]

Hi,

One way to do it might be to put some code in /etc/profile to check the valid group and exit otherwise.

JP

[Michael Tully]

As far as I know you can't without doing some hacking. As suggested by SEP you could do a test from within /etc/profile to check the group at the login stage, or just create a secondary /etc/passwd file with only those entries with the actual group involved.
BTW: I didn't know you suffered from dementia ... ;^) (Must be that rocky mountain air)

[Michael Tully]

Hi Rick,

I had a look around and couldn't find an exact example of allowing just certain groups, but the below posting has some on actual users and multiple users.

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0x431472106351d5118fef0090279cd0f9%2C00.html&admit=716493758+1069192693577+28353475

Cheers
Michael

[Steven E. Protter]

I'm reading Michael's first post. It seems familiar, but I can't remember being on this topic.

Anyway, I looked at the who command it provides nothing.

Here is how I'd do the hack.

I'd use awk -F to get the group number from the /etc/passwd file. I think its the forth field. $4

Put it in a variable.

Then decision making based on what I get back.

if [ $GROUP -eq 200 ] then
echo "You are not authorized for log in."
echo "You have been a very naughty user."
exit 1
fi

I'll work on the awk command and if I get it, I'll post it up.

SEP

[Steven E. Protter]

Here is the hack.

It assumes $LOGNAME variable is set.

tfile=/tmp/$$.dat

grep -i $LOGNAME /etc/passwd > $tfile
for grp in `awk '{ FS=":"; print $4 }' $tfile`
do
# $user=`awk '{ FS=","; print $1 }' $userstring`
# passwd -r file -n $MINDAYS -x $MAXDAYS $user
echo "$grp"
# passwd -f $user
# passwd -x 48 $user
# /usr/lbin/modprpw -l -k $user
# useradd -m $user
# echo "Command2: passwd -f $user "
done

rm $tfile

That gets you the group id, which was much harder than I thought it would be to get. This only gets the primary group though.

Combined with the last post, thats how I'd do it. I'm also quite glad I DON'T have to do such things. This one gave me a headache.

I'm going home now to watch my kids. I sense another headache coming on.

SEP