Shut Out remote access with Application Admin Account GROUP.

[Kento Uno]

Hi there.

I want to shut out remote access with Application Admin Account GROUP.
On Solaris environment, I can do this via setting up "login.access" file.
But I don't know how do I acheive this On HP-UX environment.
If you know the way, please teach me.

Regards,
KU

[Alexander M. Ermes]

Hi there.
Try SAM --> Network & Communications --> System Access --> Remote logins

Rgds
Alexander M. Ermes

[Animesh Chakraborty]

Hi,
There will a file called .rhost and /etc/rhost.equiv
Edit these files and remove the entry of those remote logins.
.rhost will be in home directory


best of luck
Animesh

[Michael Tully · Accepted solution]

Hi,

If you wish to restrict IP address have a
look at the /var/adm/inetd.sec file. There
is a man page for this. OR you could try
and restict what group id that each is
in by evaluating them during login. Have
a look at the following posting that should
help you.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x99268ffa98a2d5118ff10090279cd0f9,00.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x5e06670142b2d5118ff10090279cd0f9,00.html

HTH
-Michael

[Sridhar Bhaskarla]

Kento,

There is nothing by default that can disable a set of users to do "remote" activity. We are talking about utilitiles like "remsh", "rcp", "rlogin" etc.,

For telnet and rlogin, you can edit /etc/profile and place some checks to see if the UID matches the restricted and then deny access. But you can't stop them using rcp or remsh.

The best you can do about is to allow only the known IP addresses of the users that can do "remote" activity on the system using /var/adm/inetd.sec and denying for all others.
Depending the type of access you want to deny, you can use either "telnet" or "login" services.

-Sri

[Wodisch]

Hello,

in case you want to block off special users, but not all of them, then you need to modify the login scripts for ALL KINDS OF LOGIN, i.e. for TELNET, RLOGIN, FTP, XDMCP (=X-Windows), and all you might have additionally.
The files to insert statements into like this:

case "$(logname)" in
jill|john|fred|carly|moe|larry) echo "ok" ;;
*) echo "You are banned"; exit 1 ;;
esac

are these:
/etc/profile
/etc/csh.login
/etc/dt/config/Xsetup
/etc/ftp/ftpusers

HTH,
Wodisch

[Kento Uno]

Thanks to All, I could solve this issue.
I extended .profile to call script which are following.


GID=`id -g`
if [ $GID -eq 1002 ]
then
# For VIRTUAL CONSOLE
VCON=`tty | sed -e 's/^\/...\///'`
#echo $VCON

# For Current ID
CURRENT_ID=`whoami`
#echo $CURRENT_ID

# For Original ID
ORIGIN_ID=`who | grep $VCON | awk '{print $1}'`
#echo $ORIGIN_ID

if [ $CURRENT_ID = $ORIGIN_ID ]
then
clear

echo "\n"
echo "============================================="
echo " Security Warning! "
echo "============================================="
echo ""
echo "You cannot log into the dba account directly!"
echo "Please login your personal account, and then "
echo "use su command to get into dba environment. "
echo ""
echo "Sorry for your inconvenience."
echo " Tech Team"
echo "---------------------------------------------"
sleep 20
exit 3
fi
fi

exit 0