Restricted login to server

[yulianto piyut]

hi all,

how to restricted user login to server hp-ux ?
I want to restricted some user to login to server.

-yut-

[Md. Farhan A Azam]

Hi,

What type of restriction you are asking about...

Is this FTP user or Telnet, SSH.

What is the OS version.


thnx...farhan

[Hakki Aydin Ucar]

OR do you mean with restricted users SAM restricted user:

SAM - system administration manager

# sam -f
## Execute SAM with the privileges associated
with the specified login. When used in
conjunction with -r, the Restricted SAM
Builder is invoked and initialized with the
privileges associated with the specified
login.

# sam -r
## Invoke the Restricted SAM Builder. This
enables the system administrator to provide
limited non-superuser access to SAM
functionality.

[yulianto piyut]

to deny ssh login, but user still can sftp & scp.

[Hakki Aydin Ucar]

You must be clear what you want first then:

You should always block access to root user/group:
Open /etc/ssh/sshd_config file:

# vi /etc/ssh/sshd_config

Append following names (directives):

DenyUsers user1 user2

[Hakki Aydin Ucar]

oops..

I was in Linux box when I trying it, apparently it is not good for HP UX:

check this post and its attachments :

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=851253

[yulianto piyut]

hi,

editing sshd_config and add "DenyUsers username" can restricted some user to login to server, but user can not make sftp or scp to server. I just tried it.

[F Verschuren]

you can change the .profle of this user and put exit in there.

sftp does not go true the profile and ssh is.. so will exit.
Be aware that the user is able to change its profile whit sftp...

an other option is to create a sftponly shell. this is some work (not able to give a exapmel ad this moment)

[Kapil Jha]

You can try to put shell as false, and it owuld not allow the user to get a shell.
I suppose user can do sftp etc.

BR,
Kapil+

[F Verschuren]

I was mistaking about the shell. is is not al lot of work, just put the shell on
/usr/bin/false
and make sure /usr/bin/false is not in the /etc/shells file.

a exit 0 in the .profile is a extra (that alsow will work....

[Hakki Aydin Ucar]

Hi again,

maybe this docs OR similar in docs.hp.com will be useful as supplementary support :

http://docs.hp.com/en/5991-7517/ch01s04.html

[Hakki Aydin Ucar]

I somehow found sshd_config commands.
Attached.