RSA Security/sdshell problems

[Scott Edwards_6]

We have implimented use of RSA security on our 11.11 system. To do so the RSA shell sdshell is loaded at login in the passwd file. Everything is fine until the users starts Robelle's suprtool and opens and Oracle database instance which then prompts for the RSA passcode again. Can anyone tell me how to reset the default shell after the sdshell has executed at login so we are not prompted again for the passcode when anther shell is spawned?

[Steven E. Protter]

Oracle is not certified on that shell.

Is certified for ksh korn shell or posix.

The oracle user id needs a regular shell I think.

SEP

[Scott Edwards_6]

This seems to be true. My question then would be how to change the shell after logon. This has to be done so that the shell is changed in the /etc/passwd file after logon using "chsh $LOGNAME /usr/bin/sh" but then it needs to be returned to the RSA shell "/opt/ace/prog/sdshell" upon logout. It can not be left to the user to do this or they will bypass logging on through the RSA/ACE server the next time the login. Thanks for the help!

[Steven E. Protter]

At the command prompt:

/usr/bin/ksh

That changes you to the Korn shell.

Scripting, especially the oracle startup scripts needs to specify the shell.

#!/sbin/sh

Posix shell.

SEP

[Denver Osborn]

It would be possible to set oracle's shell to /bin/sh and still use SecurID auth for the initial login if you use a patched build of OpenSSH.

There are patches avail for OpenSSH that add SecurID support. Here's a url w/ the patches for more info. If you need steps on how to compile, let me know. I'd be happy to share my experience w/ building and using OpenSSH with SecurID support.

http://sweb.cz/v_t_m/


-denver