Preventing groups of users from logging in

[Matt Rieman]

Hi,

What's the easiest way to prevent groups of users from logging into an HP-UX 10.20 system?

Thanks,

Matt Rieman

[Pete Randall]

Matt,

Here's a link which talks about the "nologin" feature. That may be of some help. The only other thing I can think of is to trap them in /etc/profile and throw them out there.

Pete

[Pete Randall]

Matt,

In particular, the link provided by U.SivaKumar shows an example of preventing user login via a script.

Pete

[MANOJ SRIVASTAVA]

Hi Matt


you can add the following in the /etc/profile which will throw a specific group of people out :

groupid=`groups | awk '{print $1}'`

echo $groupid
if [ $groupid = oracle ]
then
exit
fi

Manoj Srivastava

[Tomek Gryszkiewicz]

You can also change the shell of a specified users to eg. "/usr/bin/false"

Regards,
Tomek

[Matt Rieman]

Pete,

How do I find the link provided by U.Sivakumar?

Matt

[Pete Randall]

Matt:

I'm very sorry, I thought I pasted the link. Anyway, here's the first link:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xb0d2a848deccd61190050090279cd0f9,00.html

and the particular one:

http://www.interex.org/pubcontent/enterprise/jul01/09uxqa.html

Pete

[Wodisch]

Hi Matt,

be careful to NOT forget the graphical logins, ie.e. CDE/XDM!
So for TELNET/SSH/RLOGIN/REMSH/XDM logins to be restricted you'll have to modify e.g. "/etc/profile" (for the first four of them, but only in the case they use "ksh" or "sh" or "bash", but NOT "csh"), and for the latter it would be "/etc/dt/config/Xstartup":
- check for the restrictiions you want, like number of existing logins: n=$(who -u|grep "^$LOGNAME "|wc -l)
- then use the exit code to restirct: if [ $n -gt 5 ]; then exit 1; fi

HTH,
Wodisch