restricted user account

[Elena Leontieva]

Hi,

Can I create a user account that could not start a telnet or X Windows sessions.

Thanks in advance.
Elena.

[Mark Grant · Accepted solution]

Maybe you could start the user with a restricted shell (rsh on HP-UX) and modify the users PATH so they couldn't access the commands. Can't remember if a restricted shell stops you setting a new PATH but you could probably set it as a read only variable with "typeset -r".

Not sure if this is good enough though.

[Brian Bergstrand]

I take it you don't want them logging in then. Or do you want ssh/console only? If you want a no login account, just make sure a * is the password field of /etc/passwd. No login allowed, but you can still run processes as the user.

HTH.

[Andrew Cowan]

Hi Elena,

You can start a user in a chroot jail and then they can only execute specific commands.

The other is with ACL's but this depends on what type of filesystem you are using.

Good luck,
Andrew

[Sridhar Bhaskarla]

Hi Elena,

You could modify /etc/profile|csh.login and Xstartup files to disallow the user from telnet or Xwindows.

However /etc/profile|csh.login is not a 100% shield. I would go with Brian's suggestion to create a user with disabled password. Install sudo and gives rights to the users that need to 'su' to this account and startup the processes.

-Sri

[Glen Trevino]

One of the things I do for automated ftp accounts is to set their login shells in the passwd file to /sbin/false so they cannot start a shell vi telnet,rsh,ssh etc. But I don't think this will stop an X windows login. If you set the password field to '*', that will disallow logins all together.

What is this user account for?

[Elena Leontieva]

Hi,

They want to have an account for printing only ( no telnet or X Windows sessions). The problem is that a print request from HP passes through multiple machines. Currently the only way to separate the different print jobs for accounting purposes ( billing the clients) is the user account ( login name on HP system). Operators who do the printing for, say two clients have the same login names on two HP systems running these two applications. So because the user login name is the only information passed to the billing program, it can not distinguish between two clients and charge them correctly.

Thank you for the responses.
Elena.