[SOLVED] Set a user to noglin via ssh but allow su to iy

lewpatch · 01-06-2010, 01:42 PM

I would like to set a Linux user (RHEL 3.x and RHEL 5.x) to no
direct login via ssh but still allow an su to it from other accounts.

A Google hit suggests setting the shell for the user to /sbin/nologin, which, according to the Google hit, should not affect an su to the account.

I tried that and when I attempt an su to the account, the message
received is "This account is not currently available".

Would appreciate some help in getting this configuration to work.

Thank you.

TB0ne · 01-06-2010, 02:37 PM

Quote:

Originally Posted by lewpatch

I would like to set a Linux user (RHEL 3.x and RHEL 5.x) to no
direct login via ssh but still allow an su to it from other accounts.

A Google hit suggests setting the shell for the user to /sbin/nologin, which, according to the Google hit, should not affect an su to the account.

I tried that and when I attempt an su to the account, the message
received is "This account is not currently available".

Would appreciate some help in getting this configuration to work.

Thank you.

Try setting the DenyUsers directive in the sshd_config file. See options here:
http://linux.die.net/man/5/sshd_config

In your case, set the user up as normal, then add:

Code:

DenyUsers <username>@*

restart SSH. The user will get dropped from ANY network address, an attempt to login will be sent to syslog, but you'll still be able to log in as another user, then SU to the account.

lewpatch · 01-07-2010, 11:09 AM

Thank you - this technique worked fine - aprpeciate the help.

TB0ne · 01-07-2010, 12:43 PM

Quote:

Originally Posted by lewpatch

Thank you - this technique worked fine - aprpeciate the help.

No problem...glad it worked out.