Keeping out user "oracle"

[bigdaddy01]

Guys,

I have a problem, I have oracle administrators that log in to my solaris servers as oracle. This stops me from tracking who is on the box. Is there away to stop the user oracle from logging in, yet run on the server ok ? Like root it has no access if it logs in remotely, it only works on the console. Something like that !

cheers !

P.

 

[dbase77]

Hi,

You can check base on IP's if he/she logon remotely. Use last command to check them.

Or change the shell for oracle user to nologin. Create shell script called nologin that will echo warning msg and quit straight away. Remember that if you put oracle shell as nologin you wont be able to do any work as oracle unless you change back the shell which I think straight forward enough. It just more work for you.

feroz

 

[bigdaddy01]

Ok how do I change the shell to nologin ?

And for the other way, where do I run this script do I run it from there profile ? if I do cant they stop it and drop to the shell if they are quick enough ?

Thanks its got me to look in the right direction!

 

[bomberman]

If you change the shell to nologin or any such non-existent shells, you have to update /etc/shells with it and do a usermod -s /bin/nologin oracle . That will prevent any login whatsoever, including su, since you will get a "no shell" error. If, however, you only want to lock the ID from logon, you can use this method that will exit their login shell only but they can still su to it.

(insert text where it matches)

/etc/.login

case 2:
echo "You have mail."
breaksw;
endsw
# start user security deny login
onintr -
set USER = `who am i | awk '{ print $1 }'`
foreach user ( oracle )
if ( "$USER" == "$user" ) then
echo ""
echo "*** Warning: This ID does not support interactive login. ***"
echo "********* Please sign on using your local account. *********"
logout
endif
end
# end user security
endif
#

/etc/profile

2)
echo "You have mail."
;;
esac
# start user security deny login
USER=`/usr/bin/who am i | awk '{ print $1 }'`
for user in oracle
do
if [ "$USER" = "$user" ]; then
echo ""
echo "*** Warning: This ID does not support interactive login. ***"
echo "********* Please sign on using your local account. *********"
exit
fi
done
# end user security
fi
esac


Tom Pietschmann
DST Systems, Inc.
Kansas City, MO