su command

[CIS BDLM Ms KAREH]

I have an id that multiple users know the password.

Is it possible to allow that user to login only via another user by using the su command.

Example:
userx is denied to log in.
For userx to log in, usery will have to log in then usery will have to su - userx.

[Ken Hubnik_2]

Yes, that is probably the best way to do it so you have an su log .

[Steven E. Protter]

This is really a policy issue.

When we find a user id is being abused the first think we do is lock it.

passwd -l userid

Then we notify the user and his or her supervisor to stop password sharing or whatever the violation is.

We then reset the user password(if a new id is needed we create it). Then we reset the user id force a change on the next login and get the user to sign acknowledgement of our security and password sharing policy.

Trying to enforce this stuff with the system is tough, people need to know they are risking their job with security violations.

SEP

[Robert-Jan Goossens]

Hi,

Something like this,

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x59d7cdec06f1d61190050090279cd0f9,00.html

Hope it helps,

Robert-Jan.

[Chris Vail]

This in fact is an excellent idea. We've locked out both the root and oracle users this way. In order to log into a host, everyone must first log in using their private accounts, then su to root, oracle, or a couple of other key accounts that we've identified. The exception to this is when they've logged onto one host, and used secure shell to log on to another host. Then, of course, secure shell logs its activities as well.


Chris

[CIS BDLM Ms KAREH]

I would appreciate any solutions or suggestions.

Thank you.

[john korterman]

Hi,
in ksh you can make use of the LOGNAME variable: the name with which the user originalley logs in is assigned to that variable. You can then test on the original logname in the .profile for the user to which you will only allow to su.
Example of the .profile for the user flipflop:

#!/usr/bin/sh
if [ "$LOGNAME" = "flipflop" ]
then
exit
fi

which will prevent flipflop from loggin in directly, but allow su - flipflop.

regards,
John K.