[jperret]

I have high level application accounts (i.e. oracle)that I normally do not alow user to directly log into. They must first login with their personal account and su to these application accounts. This way I have a record (via su) as to who is using these accounts.

But now we have come across a need for a user to directly login in using these accounts. Is there a way to turn on and off the rlogin=true/false depending on the hostname of the user who wishes to connect.

This looks like a need for a homegrown secondary authentication method.

Any ideas?

[rydekull]

I have found that it very seldom is a need for a login directly to a group/applicationaccount, mostly it's just a convenient matter or lack of knowledge matter.

If there however absolutely positively must be a need it can more or less always be dealt with sudo, as we currently have as the best method to offer something similiar to a RBAC solution.

And, if it's only for a short while, open it up, say go ahead, turn it off the next day/in a few hours/in 5 minutes.

[kinay61]

To change the value of rlogin for the user toto, you can do
chuser toto rlogin='false' / chuser toto rlogin='true'
but I don't see how you can use this command before the user connect.

You can use the file '/etc/hosts.equiv' or $Home/.rhosts
to specify the hosts or/and the user which can do a rlogin