How to protect users like "oracle" or "grid" from being accessed by "root" user?
Hello.
Environment:
Many of the Linux and AIX machines at our customer sites are deployed by our company.
Question:
How to protect users like "oracle" or "grid" from being accessed by the "root" user.
Is there a documented way to achieve this goal?
- Customers should know password of 'root' user
- blocking the root user is not an option
- restrict /rm 'su' is not an option
Workaround:
I wrote a bash script 'addsec' and added it to the '/etc/profile.d/bash.sh' environment:
/bin/bash /home/oracle/bin/addsec
The content of this script is hidden with 'shc'. This script asks for an additional password if someone tries to connect to a protected user. In addition, the script can identify whitelisted users by sms or email (one-time passwords) and send the log to a remote SNMP server with encrypted fs. The second script (monitor) runing in memory and checking for modification of the '/etc/profile.d/bash.sh' file, if it has been modified by someone, the script immediately recreates this file.