Questions on stoping user from logging in

[Mike_305]

Hi,

I have 1200 user on my rp7410 system and does any one has any idea on how can I stop this users from logging in to the system.

I only want root to have access during the maintenance time.

Thanks,

Mike

[Michael Tully]

A real simple solution. Make a copy the /etc/passwd file and remove all lines except for the users you want to login. When your finished your maintenance, move the copy back.

[Sundar_7 · Accepted solution]

Sure, there is a much better and supported way of doing it :-)

What is the OS version ? 11.0 or 11i ?

# vi /etc/default/security
NOLOGIN=1
#

# touch /etc/nologin

Now only root will be able to logon to the system.

If 11.0, you need to install a patch that enables login framework to use /etc/default/security file.

[Victor BERRIDGE]

Or change permission on /home (that is if you users are here) to read only (remove the execute)
...

All the best
Victor
(Yep I just finished a bottle of wine.and I know I should go to bed...)

[Rick Garland]

You can use /etc/security and input nologin. If the /etc/nologin file exists this will take effect. This is a new feature in 11.11

For earlier versions modify the /etc/profile to do checks of the user and of the existence of a /etc/nologin file. If the /etc/nologin file exists and user is not root then exit.

[A. Clay Stephenson]

Creat a file "/etc/nologin" owned by root

echo "" > /etc/nologin

Next, add this entry to /etc/default/security:
NOLOGIN=1

Now only root will be allowed to login; other users will be denied access and a message explaining why will be issued.

To revert to normal behavior, set NOLOGIN=0.

[Mike_305]

Hi,

Running 11i â installed from June 2004 O.S cd.

Last time I did this by removing the entry in password file and when the restore was done all my permission on files and directory were messed up.

I like Clay and Sundar's idea better. Just one question, does it do any thing with password file?

Also while I was writing the reply and all happy I check the system and there is security file in /etc/default

# pwd
/etc/default
# ll sec*
sec* not found
#


Thanks,

M

[Mike_305]

Hi,

forgot to ask is can I just create the file call "NOLOGIN" under /etc and also create the directory called "security" in /etc/default.

Also, befor someone thinks that it's a patch issue, just to let you know I have the PHCO_27694 - s700_800 11.11 login(1) cumulative patch.

Thanks,

Mike

[Sundar_7]

Mike,

It does nothing to the /etc/passwd file and if the file is not present, you will have to create one.

- Sundar.

[Sundar_7]

file name should be /etc/nologin (in lowercase letters).

/etc/default/security is a file and not a directory

# echo "NOLOGIN=1" >> /etc/default/security
# touch /etc/nologin

You are good to go.

[Mike_305]

Thanks Guys for quick reply.

What I will do without ITRC.

Thanks,

Mike

[Victor BERRIDGE]

Hi Mike,
About the security file:
http://docs.hp.com/hpux/onlinedocs/B3920-90091/B3920-90091.html

My previous mail was a joke...
I did this a long time ago (7 years ago) when I di a silly chmod 644 . forgot the reason now
And went off for lunch when I came back I had loads ofcomplaints of people that coulndt login.. I didnt see why since I could...
Teh reason: they were in /users and I in /home.
. was ./users
...


All the best
Victor

[Mike_305]

Hi Guys,

I try to change following message by putting contant in /etc/nologin file like.

"NO LOGIN ALLOWED" but it still display the following message.

Only superusers are allowed to login at this time due to the presence
of the file /etc/nologin and NOLOGIN option set in /etc/default/security
Logins not allowed at this time

How do I change the message?

Thanks,

Mike

[Sundar_7]

I dont believe you can change this message, Mike. Not that I am aware of.

Why not change the /etc/issue file and include the note?

1) Make sure telnetd has -b /etc/issue option defined in /etc/inetd.conf

# grep telnetd /etc/inetd.conf

2) echo "NO LOGINS ALLOWED DUE TO SYSTEM MAINTENANCE" >> /etc/issue

[Francis_12]

Hello Mike,

That's not possible, see here why :

# uname -r
B.11.11
# whereis login
login: /usr/bin/login /usr/share/man/man1.Z/login.1
# cd /usr/bin
# strings login | grep -i superuser
Only superusers are allowed to login at this time due to the presence

The message is hardcoded in the binary.

Hope this helps, Bye.

Francis.

[Mike_305]

Hi Francis,

I guess you are right but please look at this HP doc and it shows how to change the message.

Document id: KBRC00005800

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000062907697

No wonder the the doc info was not working when I try.

Thanks guys.

Mike

[Mike_305]

Francis was right. Can't change the message.

Thanks Guys.

Mike