Thrusted System

[Marcel Garcia Will]

If I enable the login time an user, Can I make su to this user from other user? If I can, how I configure it?

Thanks

[Steven E. Protter]

The answer to your question is yes.

su - username will give you the user along with the environment. Take out the dash and you only get priviledges.

Trusted System is done either by running Bastille Security Checker or by Going into sam Security(obvious from there) as root user.

The only configuration after that is to make the audit logs manageable. Too much logging and you just fill up filesystems.

SEP

[Marcel Garcia Will]

thanks SEP, but it cannot resolve my problems.
I??ve added a login time policy to an user.
If I want to make su - [user] from other user besides root, the su - [user] fails. su - [user] obey login time policy, like telnet?

in time, I need to make su - [user].

[Steven E. Protter]

Greetings,

I do not fully understand your problem.

Here is what I understand.

You limit logins based on time.

Do you want to enable or disable su - logins.

What is the error message you receive.

Detail will help me understand.

SEP

[Michael Tully]

This is not the way this should work.

The security policy can only be enforced if:
The user logs in
If you su - xxxx you are changing the rules.
Each su session is recorded in syslog/sulog.

Why do you wish to su anyway? Why can't the user use his/her own login ? There are ways that file permissions can be manipulated with groups and acls.

Within the shell there is an idle timeout facility (TMOUT and autologout depending on the shell type)

I am sure that you compile or change options with using the 'sudo' product where there is a timeout.

[Wouter Jagers]

I think Marcel wants to know whether it is possible to switch to a time-restricted account while outside of the 'allowed logon hours' of the target account.

I guess not, since I assume this policy is checked at -every- logon, including su's.. hence, as a non-root user I don't think it will work.

Best regards