The only tasks that I can come up with that require that the user sign
on to the operating systems are:
1) installing the Sybase software and updating/upgrading it.
2) starting the database and backup servers
3) looking at the system logs (but then so can any user who's a member
of the sybase group.

I've got a bunch of operational DBA's who insist that they need the
OS-level logon be available to them on an as-needed basis, rather than
requesting the current password from our firecall system.

I'm getting what sounds like a lot of BS (vague terms and nothing
specific) and the Sybase manuals are great at what tasks the DBA can
perform from inside the server.

HOWEVER, it's the OS-level login that I'm concerned with and want to
lock down.

So far, it's not hanging around the office on a Post-It note, but
close....

Please excuse this message -- I reposted my original question when I
couldn't find it. Turns out that I hadn't done a refresh of the newgroup on
my system...

Apologies...