Trusted system: block direct logins?

[Jeff Crew]

How do I block direct login to an account (eg. un-named accts vs. joe.user) on a trusted HPUX 11i server? Where it will require a login to joe.user before su to an un-named account.

On as regular system isn't that you put an ' * ' in the password field?

[A. Clay Stephenson]

On either a trusted or untrusted system, you can run "passwd -l user" which has the effect of locking the account by replacing the passwd hash with '*' on an untrusted system or by putting an administrative lock on the account if trusted. However, in both case, a regular user cannot then su to a locked although a super-user can. This should be obvious (especially if you consider an untrusted system). What set of 13-character passwd hashes is possibly going to match '*'. Obviously, the answer is the empty set. Because a regular user is always prompted for a password using su, the command can never succeed.

Now, you can rethink the problem and install sudo and it is perfectly legal for a regular user to perform a sudo'ed action using a locked account.

Get it from here:
http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/sudo-1.6.8p9/

[Jeff Crew]

So I can, w/ the trusted system, put an "Admin Lock" on an accout but only a super-user can the su to that locked account. A "normal user" can't get to the account until the "Admin Lock" is removed. Correct?

And what I'm gatherng is I can't easily setup an account like "oracle" and block the direct login while allowing you, me, or other users to su to that account.

Any other suggestions on how to accomplish this login feature?

[A. Clay Stephenson]

As I said before, sudo is your friend. It would allow, for example, user mickey to execute sqlplus as the locked user oracle and it would log the fact that mickey used this command.

Do a search on "sudo" and you should get tons of information. Although it's not an out-of-the-box HP-UX utility, it's a very common and secure UNIX tool to handle exactly your situation.

[Jeff Crew]

-