Restrict non-root user login

[David Lieberman_1]

I have two 11.00 trusted systems. I want to restrict a non-root account from CDE and telnet logins so that users must su to it to use the account. The account still needs a shell, so setting the account's shell to /sbin/false is not an appropriate solution.

Regards,
David Lieberman

[Sanjay_6]

Hi David,

Try this link on how can restrict a user from doing telnet. They can however su to the userid.

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=e717c00a0d699871b1/screen=ckiDisplayDocument?docId=200000051899524

Hope this helps.

Regds

[Sanjay_6 · Accepted solution]

Hi David,

To restrict CDE access, you can try this,

http://us-support3.external.hp.com/cki/bin/doc.pl/sid=15c508ab061df62797/screen=ckiDisplayDocument?docId=200000058693861

Hope this helps.

Regds

[S.K. Chan]

In the case of CDE login restriction, perhaps you can try this.
Put Xsession.d script to identify authorized users. Scripts in /etc/dt/config/Xsession.d will be sourced by CDE Xsession at login.

Example :-
/etc/dt/config/Xsession.d/0001.restrict:

case "$USER" in
root|lpd|johnb)
:
;;

*)
/usr/dt/bin/dterror.ds 'Login to CDE denied for user: $USER\n' 'nologin'
exit 1
;;
esac

[David Lieberman_1]

Thanks Sanjay and S.K. Chan. Regarding the telnet issue, to prevent the user from changing its .profile, root must control it (not mentioned in the doc).

[thebeatlesguru]

For Bourne and POSIX shells, add the following to /etc/profile:

#unsupported statements to prevent users from login but allow su.
name=`logname`
if [ $name = username ]
then
echo $name not allowed to login...only su
exit
fi
#end

i add it to my /etc/profile,but it does work,what's wrong?
following is :
name=`logname`
if [ $name = pin2 ]
then
echo " $name not allowed to login..only su"
exit
fi