Security

[Tim D Fulford]

I know about /etc/securetty restricting root's login ttys/console, however is there a similar file for each user? I have some common application logins which are quite powerful (database, application etc). I would like to force users to login as themselves then su to the appliaction login i.e.
login: joe_blog
Password: ********
% su - informix
....
This should allow me to find out what users(people, not apps) did what!
Cheers

[Ralf Bosz_2]

But this at the end of the user .profile (or in the /etc/profile):

if [ $rechtstreeks = user ];then
echo "Access Denied, use su - user"
exec sleep 5
exit
fi

Oh and just a reminder, user search next time, I got this from a search (I thought of something likewise but didn't use logname)

[Ralf Bosz_2 · Accepted solution]

Seem to forget a line which goes above the others ;)

rechtstreeks=`/usr/bin/logname`

(p.s. rechtstreeks is a Dutch word voor "straight" so you can make-up your own variable here)

[Jon Gittoes]

Is this the only method of resticting login? I'm used to AIX, where you can set login=no and rlogin=no, surely there must be a better equivalent than putting something in the .profile?

Thanks

Jon. ( I have the same requirement as the original poster)

[Patrick Wallek]

The way we have done this is to use sudo and to set the password of the appropriate account as an invalid password (like a *). We then set up a script (or alias) for the users so that when they type oracle, it does a 'sudo su - oracle' and then asks for their password. Also via sudo you can control who does and does not have access to the script.

Doing this also makes sure that no one logs in directly as the application id, but forces you to do an su.

[Tim D Fulford]

Many Thanks for the replies

It took me a while to clear this one up! sorry, I'm using Ralf's method. It is not what we want exactly but it has similar functionality.

Sudo is a definite contender for the future, but one step at a time

Again many thanks all

Tim F