Preventing users from logging in

Preventing users from logging in

If you want to prevent users from logging in to the system, but don’t want to change the runlevel to single user mode, there is another choice to do this. In the file /etc/default/security there is a variable called NOLOGIN. If you change it to 1 – practically, this means uncommenting that line – you will have a means to avoid new user to log in. If it is set to 1, every application that use session management with pam_hpsec (like ssh) will check the presence of /etc/nologin. If the file /etc/nologin exists on the system, no more users will be able to login to the system, every user attempting to login will be presented with the contents of that file. Of course root is immune to this, so you can’t lock out yourself from the system. You can do e.g. this:

# echo ?System Maintenance until 4am - logins disallowed? > /etc/nologin

This is also the way the shutdown process works. If you reboot the system, this file will be automatically erased, no matter if you made it manually or it was created by a shutdown process.

lvcreate can return the error: "Argument out of domain

PROBLEM
lvsplit and lvcreate can return the error: "Argument out of domain".
How to resolve this message?
Example 1:

# lvsplit /dev/vg01/lvol4  
lvsplit: The logical volume "/dev/vg01/lvol4b" could not be created:   
Argument out of domain 
lvsplit: Couldn't delete logical volume "/dev/vg01/lvol4b": 
The supplied lv number refers to a non-existent logical volume. 

Example 2:

# lvcreate -L 528 -n lvol5 /dev/vg05  
lvcreate: the logical volume /dev/vg01/lvol05 could not be created: 
Argument out of domain 

or

# lvcreate -D y -s g -L 361200 -n lvol9 /dev/vg201           
Warning: rounding up logical volume size to extent boundary at size "361216" MB.
lvcreate: The logical volume "/dev/vg201/lvol9" could not be created:
Argument out of domain

RESOLUTION
The formal definition of "Argument out of domain" is "You probably specified an argument a command does not support, or you specified a value to an argument that lies outside the acceptable range. Examine the syntax for the command, make adjustments, and try again." Both of the example commands above have valid arguments, which indicates the volume group configuration should be checked.

# vgdisplay /dev/vg01 
 Max LV   5 
 Cur LV   5 

indicates that the maximum number of logical volumes has been hit.
max_lv is defined by the -l option when vgcreate was used to create the volume group. From the man page "-l max_lv  Set the maximum number of logical volumes that the volume group is allowed to contain. The default value for max_lv is 255. The maximum number of logical volumes can be a value in the range 1 to 255."
Given this number cannot be changed on-the-fly at 11.x, the volume group will have to be recreated with a higher -l setting.

Significance of ignoreeof

ignoreeoff : Prventing [Ctrl-d] from logging out. Users often inadvertently press [Ctrl-d] with intent to terminate the standard input, but end up logging out of the system. The ignoreeof feature provides a safety lock to prevent this.


How to prevent your terminal from getting closed OR prevent from getting the user logged out on pressing Control-D?
The answer to this is IGNOREEOF / ignoreeof. Let us see what is this IGNOREEOF and the difference between IGNOREEOF and ignoreeof.

Control-D:
Many of the times we might have pressed some key only to realize that the terminal got closed or he got logged out from his account. The user gets logged out whenever an EOF character is pressed which is Control-D.  So, if the user happens to be in his login shell, then logically the Ctrl-D ends up in getting the user's terminal closed as well.

Bash/Bourne shell:
In Bash/Bourne shell, the log-out from the user account can be prevented by using the environment variable IGNOREEOF.

export IGNOREEOF=2

The env variable IGNOREEOF is set to 2. This means, the shell will neglect 'Ctrl-D' key 2 times. A warning message will be displayed to the user on pressing Control-D for 2 times, however on the 3rd time, the user will be logged out. So, the user can set a value of his choice. In this way, the user can prevent himself from getting logged out of the shell. It is ideal to put this setting in the profile file to make it permanent.

export IGNOREEOF

[localhost 09:19 AM ~]# export IGNOREEOF=2
[localhost 09:19 AM ~]# export IGNOREEOF
[localhost 09:19 AM ~]# Use "logout" to leave the shell.
[localhost 09:19 AM ~]# Use "logout" to leave the shell.
[localhost 09:20 AM ~]# logout


By just declaring the environment variable without any value, the shell will neglect Ctrl-D 10 times since 10 is the default value.

To unset the variable IGNOREEOF:

unset IGNOREEOF

Ksh:
The environment variable IGNOREEOF does not work for k-shell. Instead, it is done using one of the k-shell set command options, "ignoreeof". This is the difference between IGNOREEOF and ignoreeof.
To set the 'ignoreeof' option in ksh:

set -o ignoreeof

This means ignoreeof is set. Once set, the shell will neglect Ctrl-D for 20 times in case of a ksh93, 11 times in case of older ksh shells which are the default values. A user defined value cannot be set in ksh unlike the IGNOREEOF in bash shell.

To unset the ignoreeof in ksh:

set +o ignoreeof

Significance of noclobber

noclobber: Protecting files from accidental overwriting. This feature is known as noclobber. Once set, you can protect your files from being overwritten with the shell's > and >> symbols.

This particular option is designed to keep you from accidentally destroying your existing files by redirecting input over an already-existing file.

set noclobber #No more overwriting files with >

If you now redirect command output to an existing file foo, the shell will retort with a message:

foo: File exists.

To override this protection feature, you have to use the ! after the >:

head -5 emp.lst >! foo

To find out the different settings:

set -o

To unset the "noclobber" option:

set +o noclobber