telnet hpux

[kacou]

1- Is it possible to prevent all user to remoteconnect by telnet?
2- Is it possible to prevent the root to open two sections (or account) at the same moment?

[Pete Randall]

1. comment telnet out of /etc/inetd.conf (see man 4 inetd.conf for more information.

2. you could probably add some scripting to /etc/profile to count and limit the number of root logins.


Pete

[Ivan Krastev]

See /etc/default/security - http://docs.hp.com/en/B9106-90011/security.4.html


NOLOGIN
This parameter controls whether non-root login can be disabled by the /etc/nologin file.

NOLOGIN=0 Ignore the /etc/nologin file and do not exit if the /etc/nologin file exists.

NOLOGIN=1 Display the contents of the /etc/nologin file and exit if the /etc/nologin file exists.

Default value: NOLOGIN=0

For 2 - use wrapper script to count root login sessions.

regards,
ivan

[Sp4admin]

Hey Kacou,

You can turn off telnet in the /etc/inetd.conf file. On you second question I'm not sure.

sp.

[Pete Randall]

The "nologin" parameter of the security file will, I believe, prevent all non-root logins rather than just telnet. I don't think that was the intent.


Pete

[kacou]

Is it possible to prevent all user to remote connect by telnet or ssh? but i don't want to desable telnet or ssh

[Patrick Wallek]

>> Is it possible to prevent all user to remote connect by telnet or ssh?

Sure, just don't set up accounts for those users or disable their accounts.

[kacou]

what do you think about this parameter (NUMBER_OF_LOGINS_ALLOWED=0)in /etc/default/security?

[Patrick Wallek]

Did you read the man page to see what that option means? If not, you should as it is very informative and you can form your own opinion.

# man security

[Sajjad Sahir]

Dear Kacout

put # symbol in front of telnet in /etc/inetd.conf file once u made changes
run inetd -c command

[Syed Nazer Abbas]

1-/etc/nologin create the file and only one root user can login.

[kacou]

It is just two persons that I want to forbid , not all users.

[Pete Randall]

Are these two persons supposed to be able to log in by any other means other than telnet or ssh? If not, then Patrick hit the nail on the head - remove or lock their accounts and they will not be able to log in at all.

Another possibility is to have a global login script like /etc/profile, which would have code in it to reject these users' login attempts.


Pete

[kacou]

the two users must log using another acount and do ''su''.

[Syed Nazer Abbas]

well you can lock the user account.. vipw and put # on start of the username then that user will be unable to login to system.

[kacou]

HI SIED NAZER,

I have make as you said. but this user can't do ''su'' to log himself even if he logs at first by the root.

[Dennis Handly]

>Syed: well you can lock the user account. vipw and put # on start of the username then that user will be unable to login to system.

This doesn't lock the user, it renames the user to "#whatever".

If you want to lock the user, you put a "*" before their password field.

[kacou]

On the other hand I can not use 'su'. How can i resolve that?

[Dennis Handly]

>On the other hand I can not use 'su'. How can I resolve that?

su works fine to "*" out users. At least on a non-trusted system.

[Torsten.]

"I can not use 'su'"

Do you get any message?

[kacou]

see the message below:

# su jean
su: Unknown id: jean

[Torsten.]

User "jean" is not known by the system - did you modify /etc/passwd in any way?

Check this!

[Torsten.]

Based on the earlier replies I think you have an user

#jean

now instead of

jean, right?

[Syed Nazer Abbas]

user

passwd -l jean -- lock the user account.

[kacou]

I do not want that 'jean' connects by ' telnet '. But by another account, and make 'su jean ' later. i don't want to lock his acount for ever.