SUMMARY: (2) How to limit a user to login only from console?

From: Francisco Javier Arias Correa (NIC) (
Date: Fri Jul 24 1998 - 10:28:04 CDT

        It seems that I was not enough clear in my first post of the
summary, now I tried to make it clearer writting some comments on each
solution. And also there are more solutions.

Thanks to:

        Wim Olivier <>
        "Todd A. Fiedler" <>
        "Marco Greene" <>
        Dave McFerren <>
        Dennis Martens <>
        Bruce Bowler <>
        "Kai O'Yang" <> (Kevin Sheehan) (Law Hon Man)

Original question:

        I need to be able to limit one user (the user is not root) to
login only from console, not from telnet, using rexec or some other
like that. Is there any way of doing this?


1) From: Wim Olivier <>

        Put a script testing for /dev/console in his .profile. If yes,
        then do nothing, if ptty then exit. (this is about 2 lines

        Comment: The .profile of the user must be owned by some other
                 user (root), and the user must have only read access
                 permissions to the file.

                 if [ `tty` != '/dev/console' ]
                        echo "Access denied"
                        exit 1

2) From: (Kevin Sheehan)

        this will only work if the user does not modify it. You can
        also do it in /etc/profile:

          if [ "$LOGNAME" = luser -a `tty` = /dev/console ] ; then
                    echo Access Denied

        to make it unchangable by the user.

        Comment: It seems like 1 but you could deny access to more users
                 from this same file (/etc/profile). BTW, it should be:

                if [ "$LOGNAME" = luser -a `tty` != /dev/console ] ; then
                        echo "Access Denied"
                        exit 1

3) From: "Kai O'Yang" <>

        Have you considered idled? You can configure it to kick out
        anyone that is not from console, even with time of day control,
        pretty flexible.

        You can search for idled in most search engines. The author
        surname is Crider, I think.

        Commnet: I just downloaded it but I haven't tried. You can look


4) From: "Todd A. Fiedler" <>

        The only way I can think of doing this is to write a script that
        acts as a wrapper to a shell. You could then have the script
        check to see what device the user is logging in one, and if it is
        not /dev/console, you could have it issue a warning message and
        disconnect. Even better, you could write a small C program to do
        this, it would be faster and probably more secure.

        You would then need to place the script (or program) into the
        passwd file as the user's shell (item 7 in the list).

        Solaris seems to only support root console restriction.

        Comment: Write a program could be the better solution for your
                 own needs, if you have the time.

5) From: (Law Hon Man)

        Hi, I thing you should take a look on PAM on Solaris 2.6. I
        found a PAM module for Linux called list-file (pam_listfile)
        which provides a way to deny or allow services bared on an
        arbitrary file (just like /etc/ftpusers for ftp). Pls refer
        to The System Admin Guide in Linux-PAM.

        Comment: I haven't tried it.

6) From: "Marco Greene" <>
        You can always disable telnet ftp /etc/rpc and

        Comment: Very restrictive.
7) From: Dave McFerren <>

        Try putting tcp wrappers on the daemons and make sure that his
        login name is not allowed.

        Comment: It looks for the username of the one who is trying to
                 connect but not take care of the user account that it
                 is trying to login.
8) From: Dennis Martens <>
        In the file /etc/default/login, put the entry:

        Comment: This will not work only for root.


        Francisco Javier Arias Correa
        NIC-Mexico, ITESM campus Monterrey
        Tel. +52 8 328 43 73, fax +52 8 328 42 08

This archive was generated by hypermail 2.1.2 : Fri Sep 28 2001 - 23:12:44 CDT