Who has Command Line Access

[Alex Ferreira]

Greetings,

Unix is all very new to me, so I do apologise for the silly question.

How can I tell who has access to the command line? I have auditors asking me.

Thank You all for your help.

Alex.

[Michael Tully · Accepted solution]

The first things you need to look at are:

The type of shell the person has if at all. Sometimes a script will be inserted into the shell field in the password file, instead of say /usr/bin/ksh
The second is to determine whether from the users .profile they run a menu, or have an exit statement.

[malay boy]

Hi Alex,
Some comment on Mr Tully writing :

The second is to determine whether from the users .profile they run a menu, or have an exit statement.

mB -> if the user have exit statement in the .profile then it's mean that whenever user log in to the system,the system will log off the user.MEAN no session for our friends.

mB-> .profile is the file executed upon user log in.

p/s: Mr Michael Tully has magnificent knowledge in HPUX.And I also new in HP.

regards
mB

[Balaji N]

hi,

welcome to the world of unices.

until your system is not customized to that effect, normally all users who have login to the system has a shell access.

you can check this by having a look at the /etc/passwd file. The last field in the file contains the details of the shell and is normally something like sh, bash. tcsh, csh, ksh , etc.. if it is a customized script have a look at the script. another place to check is to have a look at /etc/... (profile , csh.login, etc based on the shell). this could call a customized script.

hth
-balaji

[Steven E. Protter]

As noted all users out of the box have access to the command line.

This of course can be prevented in many ways.

Here is how we do it.

We have a .profile in /etc/skel that gets used as a templete for every user that gets created.

What it does is set appropriate environment variables and runs the user straight into the main application most of our non IT users need.

Designated IT staff get user id's with a modified profile which does not do this.

To answer the question, you'll need to look at the default user profile .profile in /etc/skel if it even exists. If that profile takes the user to an application, and disables the escape key, the user does not have command line access and is totally secure.

Further examples available upon request(they are at work).

Please point the people that answered the question prior to me, Mr. value addin.

SEP

[Michael Tully]

Seems that once you know your systems better you'll be able to better differentiate what consists of a shell user and one which does not. The advice given should assist in getting the information. You could write a small script where it interrogates what shells are being used in the /etc/passwd file. Once you determine this you can discount those users that don't have a relevant shell listed.
The key to dealing with auditors is only provide what they actually ask for, don't volunteer anything.

[Alex Ferreira]

Dear all,

I thank you all for your time and expertise. I have successfully answered the questions of the vampires (auditors), and have survived..

Alex.