This is for 3 os's, AIX, Solaris, and AIX, didnt want to post three seperate times on the same subject, anyways, I want to force the user MQM to su, i.e. not be able to rlogin/telnet to the box as user MQM, only login as there ID(chris for example) and su to MQM, does anyone know how to do this, for the mentionend OS's, I believe you can only force root to su
forget AIX, its possibel, i just need to know how it can be done in Solaris 8 and HP-UX 11
Just an idea...
In the user's .profile, add the following at the top:
trap "" 1 2 3
REALUSER=`/usr/bin/who am i | /usr/bin/cut -f1 -d" "`
SUUSER=`/usr/xpg4/bin/id -un`
if [ "$REALUSER" = "$SUUSER" ]
then
stty 0
fi
Don't let the user own his/her own .profile. Owned by root, but readable by the user's group. Solaris supports RBAC (Role Based Access Control). Under Solaris you could actually have the user be a role, rather than a new user.
I'm sure there are other ways.
Cheers,
Keith
On HP you can put this scripting in the /etc/profile. That is called everytime a user logs in... and is not writable by normal users other than root.
In addition you can make it an entry in /etc/hosts.allow and /etc/hosts.deny to restrict telnet and rlogin... Just put this in these files... You may need to create them if they dont exist....
Here is a great link to a config of these files...http://ezine.daemonnews.org/200206/hosts_allow.html
I also put these others in to allow only these methods of accessing my boxes....
# cat /etc/hosts.allow
#all : all : banners=/usr/localcw/opt/sysguard/banners : allow
ftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
telnetd : <myuser> : banners=/usr/localcw/opt/sysguard/banners : allow
telnetd : all : banners=/usr/localcw/opt/sysguard/banners : deny
tftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
logind : all : banners=/usr/localcw/opt/sysguard/banners : allow
rlogind : all : banners=/usr/localcw/opt/sysguard/banners : deny
remshd: all : banners=/usr/localcw/opt/sysguard/banners : allow
sidftpd : all : banners=/usr/localcw/opt/sysguard/banners : allow
rexecd : all : banners=/usr/localcw/opt/sysguard/banners : allow
sshd : all : banners=/usr/localcw/opt/sysguard/banners : allow
root:/usr/local/bin
# cat /etc/hosts.deny
# Deny all hosts
ALL : ALL
Also, on HPUX there is a security file... do a man security to read about creating it... This file you will need to create in /etc/default/security
You can also restrict who can even attempt to su to root as well... see this part of the man security...
SU\_ROOT_GROUP
This parameter defines the root group name for the su
command. Refer to su\(1\).
SU\_ROOT\_GROUP=group_name The root group name is set to
the specified symbolic group name. The su command
enforces the restriction that a non-superuser must be a
member of the specified root group in order to be
allowed to su to root. This does not alter password
checking.
Default value: If this parameter is not defined or if
it is commented out, there is no default value. In
this case, a non superuser is allowed to su to root
without being bound by root group restrictions.
Why not use sudo, this works on most *NIX systems.
Sudo has a neat interface for setting up "allowed" commands for *NIX users.
e.g put in /etc/sudoers the line
chris ALL=/bin/su - MQM
The next time chirs logs in to the *NIX system he/she is allowed to enter:
sudo su - MQM
Which requires his/her own password.