Cybersecurity

Hi...
Its me again...
Do you know how can we prevent the user that can not access telnet from su also...I mean if I am user X and typed su - Y
(where user Y is the one that can not be used for telnet), I want this change of user to fail.
Thanks in advance

I'm pretty sure that "su - Y" will fail because you would get the same shell and not be able to do anything. But "su Y" is another matter, that will work and there is no easy way to change that.

On SunOS, su does use a facility called pam and it is probably possible to configure pam to do this. I have never used pam, and as I survey the man pages, I tend to think that this approach would be too difficult for you.

One thing that I have seen done is to restrict who can run su at all. This means that user X could not su to user Y. But the price is that user X can no longer use su at all.

To do this:
create a new group called wheel
chgrp wheel /usr/bin/su
chmod 4750 /usr/bin/su

Now anyone who needs to use the su program must be added to the group called wheel.

Thank you very much...I really appreciate your help

Hi again,
If I want to make that account that can be used for ftp only (while can not be used for telnet) bew accessable from other user (i.e., su and su - ) work. How can I do that?
Thank you in advance
Best Regards

You can probably get "su" to work. But "su -" by definition results in the same exact environment that would result from a login. Since you have disabled the account from being able to login, this means that "su -" must fail or it would be broken. You are trying to redefine "su -" to mean something different. To do that you will need to write your version of su. Sorry for the bad news.

But I would expect just plain su to work. What happens when you try?

Thank you very much for your valuable help

When I use "su" it behaves exactly as "su -"?
However, I will check it again just to make sure and inform you...

Thanks again

Hi,
I discovered a way to make users for telnet only using /etc/profile file where I check if the user is in a file which contain the list of telnet users.

Another question , I appreciate if you can help me, how can I terminate automatically an ftp session if it hangs. As Sun doc. states ftp -T will not end the session?

Thanks