From owner-freebsd-questions  Mon Apr 12  3:51: 2 1999
Delivered-To: freebsd-questions@freebsd.org
Received: from area51.quadspeed.com (node10345.a2000.nl [24.132.3.69])
	by hub.freebsd.org (Postfix) with ESMTP id 114A81547D
	for <freebsd-questions@freebsd.org>; Mon, 12 Apr 1999 03:50:54 -0700 (PDT)
	(envelope-from michel@quadspeed.com)
Received: from x-file (x-file.quadspeed.com [192.168.50.2])
	by area51.quadspeed.com (8.9.3/8.9.3) with SMTP id MAA57721;
	Mon, 12 Apr 1999 12:48:27 +0200 (CEST)
	(envelope-from michel@quadspeed.com)
Message-Id: <4.1.19990412123935.00948260@area51>
X-Sender: michel@area51
X-Mailer: QUALCOMM Windows Eudora Pro Version 4.1 
Date: Mon, 12 Apr 1999 12:48:01 +0200
To: "Ho Seng Yip" <hsengyip@singnet.com.sg>
From: Michel Quadflieg <michel@quadspeed.com>
Subject: Re: Restricting Users From Telnet
Cc: freebsd-questions@freebsd.org
In-Reply-To: <000601be8435$99da3460$38af15a5@oasis>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

Yes sure it is possible....

I did it on my machine with some of the users. I made a "shell" in which they
had 
just some options like changing the password, traceroute and ping.
I made that script and run VIPW to change their shells to the script....
I pasted you my script in the mail, I use a similar script at my work for all
customers (ISP).
Hope it helps you and you can use it

(in vipw you should edit for the users you want to have just such shell you
should set as shell /usr/local/bin/menu)

Michel

<script>
1)  /usr/local/bin/menu

#!/bin/sh
#!/bin/csh -f

cd /tmp
TERM=`echo $TERM|/usr/bin/tr -dc '[A-Z][a-z][0-9]_-'`
export TERM
exec /usr/local/bin/menu.csh

done

2) /usr/local/bin/menu.csh

#!/bin/csh -f

limit cputime 5m
#ulimit -t 300
exec /usr/local/bin/menu2

3) /usr/local/bin/menu2

#!/bin/sh

stty sane

ulimit -t 300

PATH=/usr/local/bin
export PATH

while :
do
 echo   '
======================================
    1) change password
    2) check connection
    3) traceroute to altavista
    q) quit
> '

 read ans
 case $ans in
        1)      /usr/bin/passwd
                ;;

        2)      /sbin/ping -c 1 support.euronet.nl
                ;;

        3)      /usr/sbin/traceroute www.altavista.com
                ;;
[qQ])   echo '' ; exit 0 ;;


 esac
done

</script>


At 12:06 AM 4/12/99 +0800, you wrote:
>Hi,
>
>I will like to know if it is possible to restrict certain accounts from
>being able to access the machine via telnet ?
>
>Thanks.
>
>Regards,
>Seng Yip
>
>
>
>
>To Unsubscribe: send mail to majordomo@FreeBSD.org
>with "unsubscribe freebsd-questions" in the body of the message

Michel Quadflieg
Overtoom 31-1hg
1054 HB Amsterdam

Tel     :+31 654 780 923
E-mail: michel@quadspeed.com


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message