Restricting direct login access to non-root user

[Dan Early]

Is there a way to disable remote login access for a non-root user (a DBA), so the user is required to login with an individual account and su to the DBA ID?

[Graham Cameron_1]

Yes, we do just this to prevent dba's logging in as oracle.
They have to login as themselves and then su - oracle, so we have a audit trail.

We do this by putting the following lines into /etc/profile:

trap "" 1 2 3
who -m >/dev/null 2>&1
if [ "$?" = "0" ]
then
TSTUSR=`who -m | cut -f1 -d" " | cut -c1-6`
if [ "$TSTUSR" = "oracle" ]
then
echo -------------------------------------
echo STOP! Do not logon directly as oracle
echo Do an SU in future please
echo -------------------------------------
exit
fi
fi

[Ken Penland_1]

If you have more than one special user that you want to keep out of logging in directly, you can create a special users file, and check against that file also...so a variation of the above would be this, also located in /etc/profile:

export USER=`whoami`
grep -q "$USER" /etc/spec.users
if [ "$?" -eq 0 ]
then
if [ "$Owner" = "$USER" ]
then
echo "$USER user is not allowed to log in directly"
sleep 5
/usr/bin/kill -9 0
fi
fi

[john korterman · Accepted solution]

Hi,
there is an old trick: make use of the korn shell's logname, e.g. insert in the beginning of .profile:

#!/usr/bin/sh
if [ `logname` = "oracle" ]
then
echo "direct login not allowed"
exit
fi


this will make direct login impossible for the oracle user.

regards,
John K.

[Ken Penland_1]

whoops, disreguard the Owner part, I forgot to take that out, that is some additional code that is not nesissary for what you are doing...

[RAC_1]

Put some code in /etc/profile.

trap "" 1 2 3
login_id=`logname`

if [ $login_id = "oracle cccount"]
then
echo "No direct logins allowed, use user login and do su to oracle"
exit

[Tim Sanko]

Well there are several ways. the first way is to cheat. I would not allow login to the login id oracle. (I am assuming you would want to do it this way, and are using oracle.

Have the user execute a script login_oracle. This script sets the oracle ID's password to a known password it also has the setuid bit set so that the script can be run as though the user is root. At the same time it sets the oracle password, it does an su to oracle, does a typescript, and when exited, e-mails root with the typescript file.

Along the way you will need to do several little things such as setting ignore break so the DBA can't actually get beyond the typescript.

Tim

When oracle_userID isn't active. the password field has an asterisk in it(no login).

Then to activate the account set the known password.

We have a security officer who builds the accounts and who can activate special users/vendors in this manner


Hope that is a help.

Tim

[Benjamin Shayne]

I noticed these were all ksh. At the end of /etc/csh.login, I execute the following script called /etc/login_check.csh:
#!/bin/csh -f

set login_id=`logname`
if ($login_id == 'sybase') then
echo "No direct logins allowed. Use [su - sybase] instead"
set pid = `ps | grep "csh" | sed 's/^ *//' | cut -f1 -d" "`
kill -9 $pid
endif