Restrict logins if already logged into system from one ip address

[Nick D'Angelo]

I would like to prevent users from logging in from more than one IP address.

The users are logging on from multiple workstations and letting others use their security permissions. This is not company policy or practice, therefore I would like to have the system (probably /etc/profile) look to see if they are already logged onto the Unix server from one IP address.

If they are already logged on from another IP address, then display a msg and prohibit them from loggin on.

Of course, there has to be some exceptions to this list, and that would be me, sysadmin.

[Jeff Machols]

the who -a will give the source ip of the login. YOU may be able to put that in /etc/profile so it's gets run when everyone logs in. Then see if there are any differences with the user IPs. The problem is this won't work if users can rlogin from unix box to unix box (because the source ip will be of that unix machine)

[Mark Greene_1]

You can add a call to this script from /etc/profile, and based on the return code either let the user in, or not:

#!/bin/ksh
trap "" 1 2 3
IP_LIST=`who -u|tr -s " "|cut -d" " -f8`
THIS_IP=`who -um|tr -s " "|cut -d" " -f8`
LOGIN_COUNT=0

for IP_ADDY in `echo $IP_LIST`; do
if [ "${IP_ADDY}" -eq "${THIS_IP}" ]; then
(( LOGIN_COUNT = LOGIN_COUNT + 1 ))
fi
done

echo $LOGIN_COUNT
if [ $LOGIN_COUNT -gt 1 ]; then
exit 1
else
exit 0
fi

--
mark

[Alexander M. Ermes · Accepted solution]

Hi there.
Pls check this URL :

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x431472106351d5118fef0090279cd0f9,00.html

You hsould find the answer in these postings.
Rgds
Alexander M. Ermes