limit the user login

[peterchu]

I hv set the limitation of user login ( /etc/profile ), that only allow max. of 200 concurrent user login to the system , but sometimes the total no of login is over 200 that the users need to wait until someone logout , now I want to let a group of staffs ( eg. EDP ) can access the system even the total no of login reach 200 , could suggest what can I do ?thx

[KapilRaj · Accepted solution]

how did u restrict ? it depends on that

Kaps

[Muthukumar_5]

check identity of the user login using id command. If the user group ( EDP ),the allow them even login limit is 200.

Get the /etc/group id for EDP and keep it for checking. ID can be used to check the identity of users too. Check the id from /etc/passwd entry for the user.

see id(1) man page more

[Borislav Perkov]

Hi,

You need to check and maxusers kernel parameter to be also greater then 200.

Regards,
Borislav

[RAC_1]

Restricting the users based on therir gid, uid will require some code to be put in /etc/profile.

With 11.0 and later, you can have file /etc/default/security. man 4 security for details. You can put
NUMBER_OF_LOGNS_ALLOWED=xxx in this file. This applies to non-root users. This would be mush cleaner way to do what you want. Also You make sure that you have set maxusers accordingly.

Anil

[Mobeen_1]

Peter,
I think it would be best that you let us know or pass the script that you are using to restrict the login in your system currently. Based on that we would be able to recommend a way.

You can put in an additional check to see the group of the person logging in and if he belongs to a certain group like EDP, let him in.

regards
Mobeen

[Jose Mosquera]

Hi,

Firts create and group the users in EDP group. Then in /etc/profile:

GRP_ALLOW=`id -Gn|grep EDP|wc -l`
if [ "$GRP_ALLOW" = "0" ]
then
...your login restriction procedure.
fi

Pls check more "id" command options with "man id"

Rgds.

[peterchu]

very thanks for the replies , and sorry that I have one more requirement of this,
As my question , I want to allow the EDP user to access the system even reach the 200 users on the system , my new requirement is I also want all EDP'slogins will not be counted . eg. if there are 150 general users and 10 EDP logins in the system , the system only recognize the system has 150 logins but not 160 , so that the EDP user will be affect the general user login , could suggest what can I do ?

attach the /etc/profile ,

very thank if you can help more.

[Rodney Hills]

Modify the following statement-

if [ "$MY" = "root" ] ;

to

if [ "$MY" = "root" && `id -g` = "##0" ] ;

Where "##" is the group id number for the EDP group. Then they will be ignored liked "root" is being ignored.

HTH

-- Rod Hills

[Rodney Hills]

Whoops,

Change "&&" (and) to "||" (or).

-- Rod Hills

[peterchu]

thx replies, I tried hill's suggestion , it really meet my first requirement , but the EDP logins still count into the 200 . that mean if there are 190 general user logins and 10 EDP user logins at the same time , the system will know there are total 200 users in the system and reject the new login , what I want is the system allow total of 200 general user can access the system and ignore all the EDP user logins .

Very thanks for further help.

[peterchu]

is it possible to do that ? thx