UNIX for Advanced & Expert Users

Need urgent help!!!
Hi,
I have an application that runs under a regular unix ID 'prod1'. I want to disable direct login for 'prod1' via ssh or telnet. But I do want some users to be able to su to prod1 and do application maintainence tasks. How can I accomplish that?

Also the above scnerio is possible, then where do I define which users are allowd to su to prod1.

If anyone can answer this quickly, I would greatly appreciate it.

Try with /etc/usertty (read more on it in manual of login(1)).
Also try 'sudo'.

Regards

set the shell of the user 'prod1' to /bin/false in the /etc/passwd file. This will logout any user that logs in to this id via telnet or ssh, but will allow 'su prod1'. It will not allow 'su - prod1' though.

my bad! using /usr/bin/false for shell will disable any shell login on that id. even su will not be allowed. the best thing to do would be to maintain the login shell for the user as /usr/bin/sh and have the user's .profile file as follows:
exit 0
only the login shell will read the .profile. so users will be unable to login to that id, but will be able to su to that id (not su - ).

disable telnet access by commenting the appropriate line in /etc/inetd.conf, restrict remote SSH access to the server through the AllowUsers construct in sshd_config, remove remote ssh access into server for "prod1" account and setup su access ... may be a big problem if lots of people need access to the server ...

or ...

lock the password for "prod1" account, and setup su access ... may be hard to do without a working password unless you can modify su to take the current user's password instead of the "prod1" account's password ...

I think the easiest way is to use /usr/bin/nologin which disallows direct login to a user id. My Oracle DBAs use it to force them to login as themselves then su - oracle.