Restricted rlogin or telnet

[CKT]

I want to limit certain users to rlogin to my server based on user name. What is the best way to implement this? Ideally when a banned user tries to rlogin my server will return a message saying that he is banned from this machine. Thanks for your help in advance.

[Steffi Jones_1]

Hi Jules,

I might be missing a piece of information, but if you don't want some users to login to the box, don't give them an account on it.
That would be the easiest and safest way of keeping users of a system (and don't give out the root password)
If you want to restrict access from a box in your net, have a look at the file /var/adm/inetd.sec

Hope that was not a too simple answer :-)

Steffi Jones

[Shannon Petry]

If there is a reason you can not remove the ID, I.E. NIS domain is not yours, etc.... Then there are two options.
1. Read up on inetd.sec via man pages or HP-UX instant information.
2. Add some goodies to /etc/profile like
I_AM=`/usr/bin/whoami`
if [ "${I_AM}" = "julie" ] ; then
echo "Sorry your bannished from my kingdom..."
sleep 2
exit
fi
This will kick them out at login.

If you can remove from passwd then remove them and be done! :)

Regards,
Shannon

[Dan Hetzel]

Hi Jules,

I agree with Steffi and Shannon as the easiest thing would be to remove them from the password file.
If you need to keep the user ID's for any reason, you may simply deactivate the account by putting an asterisk in the password field (second field, normally 13 characters long)

As no password will encrypt to a single asterisk, these user ID's won't be usable to log in.

An alternate solution would be a simple code in your /etc/profile file like Shannon suggested.

Best regards,

Dan

[Darrel Louis · Accepted solution]

Hi,

As you can see there are special ways of banning users:
- inetd.sec
All of the internet services controlled by inetd (including telnet
and rlogin) have their access controlled by the security file
/var/adm/inetd.sec. To restrict or allow particular access, specifically list the service to be restricted, denied, or allowed. Then list specific IP addresses for individual hosts or use network addresses to deny or allow entire networks. Check the man pages on inetd.sec for more information on the
format of the file. The following is an example that will allow everything on
the 15.56 subnet and the single host 192.13.12.1 to telnet in.
Telnet sessions from all other hosts will be denied: telnet allow 15.56.* 192.13.12.1

- Users profile:
modify the users .profile in his home-directory
- /etc/profile
Make a file with a list of users you want to deny. Then modify the /etc/profile to check this file first and then log them off with a message. This you can do when you don't or not able to change the password file.

Good Luck

Darrel

[Ashish Palkhiwala]

Just a thought,

How about setting up a host.equiv and .rhosts mechanism

Good luck