Sponsored Content
Full Discussion: forcing su on a user
Top Forums UNIX for Advanced & Expert Users forcing su on a user Post 46733 by Kelam_Magnus on Thursday 22nd of January 2004 04:09:55 PM
Old 01-22-2004
On HP you can put this scripting in the /etc/profile. That is called everytime a user logs in... and is not writable by normal users other than root.


In addition you can make it an entry in /etc/hosts.allow and /etc/hosts.deny to restrict telnet and rlogin...
Just put this in these files... You may need to create them if they dont exist....

Here is a great link to a config of these files...http://ezine.daemonnews.org/200206/hosts_allow.html

I also put these others in to allow only these methods of accessing my boxes....

# cat /etc/hosts.allow
#all : all : banners=/usr/localcw/opt/sysguard/banners : allow
ftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
telnetd : <myuser> : banners=/usr/localcw/opt/sysguard/banners : allow
telnetd : all : banners=/usr/localcw/opt/sysguard/banners : deny
tftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
logind : all : banners=/usr/localcw/opt/sysguard/banners : allow
rlogind : all : banners=/usr/localcw/opt/sysguard/banners : deny
remshd: all : banners=/usr/localcw/opt/sysguard/banners : allow
sidftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
rexecd : all : banners=/usr/localcw/opt/sysguard/banners : allow
sshd : all : banners=/usr/localcw/opt/sysguard/banners : allow

root:/usr/local/bin
# cat /etc/hosts.deny
# Deny all hosts
ALL : ALL






Also, on HPUX there is a security file... do a man security to read about creating it... This file you will need to create in /etc/default/security



You can also restrict who can even attempt to su to root as well... see this part of the man security...

SU_ROOT_GROUP
This parameter defines the root group name for the su
command. Refer to su(1).

SU_ROOT_GROUP=group_name The root group name is set to
the specified symbolic group name. The su command
enforces the restriction that a non-superuser must be a
member of the specified root group in order to be
allowed to su to root. This does not alter password
checking.

Default value: If this parameter is not defined or if
it is commented out, there is no default value. In
this case, a non superuser is allowed to su to root
without being bound by root group restrictions.


Last edited by Kelam_Magnus; 01-22-2004 at 05:25 PM..
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

forcing irq on PCMCIA card

ENV: linux Version: Mandrake 8.1, PCMCIA card: longshine lcs-8534TB. (supported according the PCMCIA docs) laptop is P-II lifetec /etc/sysconfig/pcmcia: PCMCIA=yes PCIC=i82365 ( found via probe -m ) PCIC_OPTS="cs_irq=11 pci_irq_list=11,11 do_scan=0" ( you see i want to force irq 11 )... (3 Replies)
Discussion started by: progressdll
3 Replies

2. Solaris

forcing users to su

Is there a way in solaris 9 to prevent a user to login via ssh, telnet, rlogin, and only be able to su as that user, for example have DBA joe blow login as jblow, and then su to oracle BUT not vice versa have DBA joe blow login as oralce (6 Replies)
Discussion started by: csaunders
6 Replies

3. Solaris

forcing password change every X days?

Hi, how do I go about forcing users to change their password every, say, 30 days? Aaron (1 Reply)
Discussion started by: amheck
1 Replies

4. UNIX for Dummies Questions & Answers

Forcing Makefile to Ignore Errors

Is there A way I can Force a makefile to ignore errors? i believe it is using gcc. i have a set of commands in the makefile that i want to run and each time the makefile gets to the point of this commands, it aborts because of the commands. how can i get the makefile to keep running... (3 Replies)
Discussion started by: SkySmart
3 Replies

5. Red Hat

Forcing a kernel panic in RHEL 5.4

Hello, Is there a way to force a kernel panic in RHEL 5.4 in such a way that the machine reboots after the panic. Thanks, Kanna (1 Reply)
Discussion started by: kanna_geekworkz
1 Replies

6. UNIX for Dummies Questions & Answers

AWK: Backslash \ and forcing output not to go onto new lines

Dear all, I am using Mac OSX, have been successfully written an awk script during the last days. I use the script to convert parts of a .dot-file into graphml code. First question: Backslash My .dot-code includes repeatedly the sign "\n". I would like to search for this sign and substitute... (4 Replies)
Discussion started by: ingli
4 Replies

7. Shell Programming and Scripting

Forcing a tty session but getting a password prompt?

I have a master host I want to use to issue some start/stop of LDAP services. I changed the client hosts /etc/sudoers to have Defaults:infra !requiretty The master host kicks off the jobs using the infra account doing a ssh session to the infra account on the clients. #!/bin/ksh ps -fu... (5 Replies)
Discussion started by: J-Man
5 Replies

8. Hardware

Forcing Linux to keep charging my Kindle

Linux seems to have weird USB power saving features, my Kindle 3 only gets some charge before Linux powers down the USB port. When the device is mounted, it doesn't get enough power, with this same hardware under Windows I don't get the message on the Kindle "currently your kindle is not... (2 Replies)
Discussion started by: John Tate
2 Replies

9. Shell Programming and Scripting

Forcing another user to run a shell script (su)

I'm trying to use su (as myuser) to force another user (theuser) to run a shell script (thescript.sh): su theuser -c /home/theuser/thescript.sh However I'm running this from another script, and it is asking for theuser's password. I would rather avoid displaying it in the file (using echo... (2 Replies)
Discussion started by: asdfgg
2 Replies

10. Programming

Forcing a write to a file without newline?

Hello, I am writing a program which runs with root privileges, and it creates a child with lowered privileges and has to redirect it's stdout and stderr to a file and then run bash. The problem is, whenever I read this file, I want to see all of the current output, even when the program is still... (10 Replies)
Discussion started by: madd-games
10 Replies
RLOGIN(1)						    BSD General Commands Manual 						 RLOGIN(1)

NAME
rlogin -- remote login SYNOPSIS
rlogin [-468DEd] [-e char] [-i localname] [-l username] [username@]host DESCRIPTION
The rlogin utility starts a terminal session on a remote host host. The standard Berkeley rhosts authorization mechanism is used. The following options are available: -4 Use IPv4 addresses only. -6 Use IPv6 addresses only. -8 Allow an eight-bit input data path at all times; otherwise parity bits are stripped except when the remote side's stop and start char- acters are other than ^S/^Q. -D Set the TCP_NODELAY socket option which can improve interactive response at the expense of increased network load. -E Stop any character from being recognized as an escape character. When used with the -8 option, this provides a completely transparent connection. -d Turn on socket debugging (see setsockopt(2)) on the TCP sockets used for communication with the remote host. -e Allow user specification of the escape character, which is ``~'' by default. This specification may be as a literal character, or as an octal value in the form nn. -i Allow the caller to specify a different local name to be used for authentication. This option is restricted to processes with uid 0. -l Specify a different username for the remote login. If this option is not specified, your local username will be used. A line of the form ``<escape char>.'' disconnects from the remote host. Similarly, the line ``<escape char>^Z'' will suspend the rlogin ses- sion, and ``<escape char><delayed-suspend char>'' suspends the send portion of the rlogin session, but allows output from the remote system. By default, the tilde (``~'') character is the escape character, and normally control-Y (``^Y'') is the delayed-suspend character. All echoing takes place at the remote site, so that (except for delays) the rlogin is transparent. Flow control via ^S/^Q and flushing of input and output on interrupts are handled properly. ENVIRONMENT
The following environment variable is utilized by rlogin: TERM Determines the user's terminal type. FILES
/etc/hosts /etc/hosts.equiv $HOME/.rhosts SEE ALSO
login(1), rsh(1), telnet(1), setsockopt(2), ruserok(3), tty(4), hosts(5), hosts.equiv(5), rlogind(8), rshd(8) HISTORY
The rlogin command appeared in 4.2BSD. IPv6 support was added by WIDE/KAME project. BUGS
The rlogin utility will be replaced by telnet(1) in the near future. More of the environment should be propagated. BSD
September 26, 2003 BSD
All times are GMT -4. The time now is 04:03 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy