restricting telnet

[Darren Murray]

hi,

I want to be able to stop an individual user id (say dba) being able to telnet to my server as I have multiple people who have the password but need access to that id so they can make program changes. I want them to have to use their individual id and then su so I can track the user making changes.

hope that make sense
Any suggestions?

[Jeffrey S. Sims]

Darren,

I think the thread located at:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xeccacf38d6bdd5118ff10090279cd0f9,00.html

will have your answer at the bottom.

Hope it helps

[steven Burgess_2]

Hi

Have a look at

#man inetd.sec

This file allows you to restrict certain types of access to your server

You then have your

/var/adm/sulog

Regards


Steve

[Darren Murray]

But I am unable to restrict by user id level with inetd.sec ???

[Jason VanDerMark]

You could simply disable the dba account by replacing the user's passwd in the /etc/passwd with a *. Then the dbas will not be able to login via the dba account, but they will still be able to su to it if use sudo of something else that will allow them to su without a password. Just some thoughts. I am sure that there is a better way.

Regards,
Jason V.

[Darren Murray]

Ended up doing it this way

name=`logname`
if [ $name = wumi ]
then
echo $name Piss off not allowed to login...only su
sleep 5
exit
fi


Wont be that unkind with the message though

[Michael Tully]

Hi,

How about a script? You could call this from /etc/profile, and it will decide if the user can or can't.

HTH
-Michael

#---------------------------------------------------------------------------
#
# This script verifies at login time, if the account is "su only"
# The account to become "su only" must be configured (listed) in the
# config.file SU_CONFIG_FILE - one per line
#
# Script is started from /etc/profile with PID of a original process
#
#---------------------------------------------------------------------------

trap "" 1 2 3

SU_CONFIG_FILE=/usr/local/etc/su_only.cfg
export SU_CONFIG_FILE
current_user=`whoami`
orig_process=$1
orig_process_name=`ps -p $1|awk '{print $4}'|grep -v COMMAND`


# kill login process if su only

exit_login ()
{
echo "\n \"$current_user\" is Privileged Account. Access only via \"su\". n"
kill -9 $PPID
}


# Check if "su account" access enabled

check_login ()
{
if [ $current_user != "root" ]
then
if [ $orig_process_name = "rlogind" -o $orig_process_name = telnetd ]
then
if [ -s $SU_CONFIG_FILE ]
then
if [ `grep -v "^#" $SU_CONFIG_FILE|grep -c "^$current_user"` -gt 0 ]
then
exit_login
fi
fi
fi
fi
}


check_login

trap 1 2 3

[Darren Murray]

Ended up doing it this way and putting this in the /etc/profile

name=`logname`
if [ $name = wumi ]
then
echo $name Piss off not allowed to login...only su
sleep 5
exit
fi


Wont be that unkind with the message though

[steven Burgess_2]

Hi Darren

to restrict the user logging in

vi /etc/passwd

change his shell to /usr/sbin/false

in /etc/shells have the entru /usr/sbin/false

when he logs in, he won't have a shell so will get logged out

He should still be able to use ftp

Is this what you are after?

Regards

Steve

[K.Vijayaragavan.]

Hi ,

In HPUX there is no readymade provissions to enable / disable (remote logins)telnet at user level.

AIX do have a file called "/etc/security/user" where we can add "rlogin=false" under each user's name.

For HPUX , as i know the best solution is to use some kind of authentication scripts at /etc/profile.

See this link which provides one kind of script
See the note posted by Peggy Fong in that.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0xbdb879bffde7d4118fef0090279cd0f9,00.html

-Vijay

[H.Merijn Brand (procura]

You *do* of course realize that if you hit ^C in the sleep fase of your script:


name=`logname`
if [ $name = wumi ]
then
echo $name Piss off not allowed to login...only su
sleep 5
exit
fi


That you just pass all security checks?

use 'trap "" 1 2 3' as first line to catch that

[Shannon Petry]

If you look at /etc/profile and /etc/csh.login that traps are already set! :)

You did just fine by restricting access by modifying /etc/profile!
I'd make it scarry for the user though...
if [ $USER = "johndoe" ] ; then
echo "Piss off...."
sleep 2
echo "press ^C to stop deleting your local files..."
sleep 10
#let him wonder for 10 seconds...
fi