1

Question: Does anyone know of any methods to perform a "second" login without using su, or a means to use su that requires the user to enter their username after the su command is issued?

Situation: We have multiple types of devices that login to a Linux server. The users can then choose from options on a menu to execute. The devices auto login to the system with a different account for each device. The reason we do this is to limit the number of setup accounts to maintain on the devices to one per device. The ssh clients we have that we can use all tie an automatic login name to the device account in use (see Juice ssh on android for one example). Maintaining 40 plus accounts per device on each app is too much overhead for us.

Goal: After the device logs in (primary login) provide a secondary login for the user that will allow them to enter their user id and password.

My first inclination would have been 'su', but 'su' needs a username provided with the command or it defaults to root account. To keep things simple, I am trying avoid writing more shell code to prompt for the username before issuing a command such as 'su - $username' to accomplish this.

Naturally, any application they login to already asks for username and password, but dropping to the shell and other home built functions rely on the login to provide authentication.

|improve this question
  • Yes, managing many users on many servers is a pain. Fortunately, this is a solved problem with centralized authentication servers such as LDAP/Kerberos. Use centralized authentication and distribute a sudoers with configuration management. Don't reinvent. – jordanm Jun 1 '15 at 13:50
  • The server is not the problem in this case, it is the end devices' applications. I am not certain how to link individual applications to an LDAP service if the app does not already have the ability built in. In the ssh case, coding something on the shell side is where I am. Maybe you mean from the device level itself? In this case, I think the SSH apps still need one setup for each user that might use the device, and those accounts would still have to be maintained individually on each device as people came and went. Please help me understand what I am not seeing here. – Bill Linder Jun 1 '15 at 15:36
0

What does it matter just getting users to type su - username in the shell, if they must type their username and password in any way? Only 5 extra characters typing :).

If it's not acceptable by users and you are so lazy as not to want to write single script anymore, just install telnet and telnetd on the server and put the following alias in /etc/bash.bashrc.

alias x='telnet localhost'

Updated: Don't forget to restrict remote accesses to telnetd port (tcp/23). You can set up firewall (iptables) or traditional TCP wrapper (/etc/hosts.allow, /etc/hosts.deny - consult hosts_access(5) manual page).

|improve this answer
  • 1
    The users using this are computer illiterate and yes asking them to remember 'su - username' is above and beyond most users' comprehension levels, otherwise that is what I would have done. Doing something similar in bash to collect the username and then issue 'su - $username' was another way to go, but I am the only one in the entire company who knows anything about scripting and programming. I have to leave things behind that non-programmers can just get. Bash is not that. This is a good idea. Kudos. I will put into play and see how it works. – Bill Linder Jun 2 '15 at 11:28
  • @BillLinder Don't get me wrong, but I could actually imagine and understand your situation. Hope my answer helps you. Btw I've updated it for security settings, please take a look at it. – yaegashi Jun 3 '15 at 3:24
  • Thank you for your input. Unfortunately this does not fix the problem. – Bill Linder Dec 8 '15 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.