redhat-secure network sevices- pam.d

ftp: 21

ssh:22

telnet: 23

smtp:25

http:80

https:443

cups: 631

works on lev3 not lev5 . if su from root account. there will no restirciton.

 

 #limit xing to login between 09-17 everyday
vi /etc/security/time.conf
login;*;xing;Al0900-1700
vi /etc/pam.d/login
account required pam_time.so

#limit user1 and user2 can not login on Saturday
vi /etc/security/time.conf
login;*;user1|user2;!Sa0000-2400
vi /etc/pam.d/login
account required pam_time.so

#limit user1 and user2 can only login 1 at a time, user in example group can get total 3 logins
usermod -G example user1

usermod -G example user2

vi /etc/security/limits.conf
@example - maxlogin 3
vi /etc/pam.d/system-auth
session required /lib/security/pam_limits.so

or

session required pam_limits.so

this one only works on lev3, when root account add into example group. seems no limit

#user1 can only have 7 processes
vi /etc/security/limits.conf
user1 hard nproc 7
vi /etc/pam.d/system-auth
session required /lib/security/pam_limits.so

this one only works on lv3, if su - xing on lv5 won't work

#deny to xing user login locally
vi /etc/security/access.conf
-: xing: LOCAL
vi /etc/pam.d/system-auth
account required /lib/security/pam_access.so
or
session required /lib/security/pam_access.so
or
vi /etc/pam.d/login
account required /lib/security/pam_access.so
or
session required /lib/security/pam_access.so

#limit jack user login to station1.example.com only
vi /etc/security/access.conf
-;jack;ALL EXCEPT station1.example.com
vi /etc/pam.d/system-auth

account required /lib/security/pam_access.so

#limit xing to access ssh remotely
vi /etc/pam.d/sshd
account  required pam_listfile.so item=user sense=allow file=/etc/ssh/sshusers
onerr=succeed

vi /etc/ssh/sshusers
xing

test from remote : ssh 192.168.1.254 -l xing  ok
if  sense=deny. will fail

refer to /etc/pam.d/vsftpd  when modi /etc/pam.d/sshd

 

# another option to stop xing from access to vsftpd and sshd

vi /etc/securiyt/access.conf

-: xing: vsftpd: 192.168.1.

-: xing : sshd : 192.168.1.

vi /etc/pam.d/vsftpd

auth  required   pam_access.so

or

account requied  pam_access.so

vi /etc/pam.d/sshd

session required pam_access.so

or

account required pam_access.so

# anothe option to stop xing from accessing to vsftpd and sshd
on server
vi /etc/security/time.conf
sshd;*;xing;!Al0000-2400
vsftpd;*;xing;!Al0000-2400
vi /etc/pam.d/sshd
account required pam_time.so
vi /etc/pam.d/vsftpd
account required pam_time.so

 

#deny local login to all normal users

touch /etc/nologin

 

#allow root to certain terminal

vi /etc/securetty