Force su to gain access to root

[Erik Kennedy]

I am trying to highten security at my site and one way that I want to do this is to force the admins to su to become root and only allow root to login at the console instead of logging in from any terminal as root. In Solaris this is accomplished via the /etc/default/login file. How is this done in HP-UX?

[Kofi ARTHIABAH]

create a file called /etc/securetty
and specify console in it - try

# echo "console" > /etc/securetty

[James R. Ferguson]

Erik:

/etc/securetty is the file you want. Do the following:

# echo console >> /etc/securetty
# chmod 600 /etc/securetty

...JRF...

[Rick Garland]

sudo is an option that allows for greater control and logging facilities. In addition the setting up the securetty file, can have the administrators do an 'sudo su'. All other users can be prevented from doing the 'sudo su' and the sudo logs will indicate who tried, when they tried, from where they tried, and what happened. The users can be placed into specific groups with the sudoers file if they need to run certain commands as root. Detail loggin will be the result of who did what and when.

sudo can be obtained from the porting center or from www.courtesan.com.

[Adi Kremer]

The same concept works if you create /etc/securetty.

If the /etc/securetty file is present, login security is in effect.
Only user root is allowed to log in successfully on the ttys listed in
this file. Restricted ttys are listed by device name, one per line.
Valid tty names are dependent on the installation. An example is:
console
tty01
tty02
etc.

Adi

[Erik Kennedy]

I have read about /etc/securetty and the thing that scares me is that from what I understand when I specify console, etc ONLY root can login at those terminals. I want to make it where root can only login at the console but ensure that other login can occur there as well. Is that possible? Thanks for the responses so far......

[Rick Garland · Accepted solution]

Yes - additional logins can occur on the console. With the securetty file you are just saying that root can only login directly on the console. The root acct cannot login directly anywhere else. This has no effect againest the other accts from using the console.

[Kofi ARTHIABAH]

Erik:

That is not exactly correct. Any one with access to the console can login. Any one can login from any where else, but in order to become root remotely, you need to su. the securetty is what you are looking for.

[James R. Ferguson]

Erik:

Do a "man login". This is where securetty is documented. It is designed for root, so other users could still login.

...JRF...

[Erik Kennedy]

THANKS!!!!! To all of you who submitted answers I appreciate it. I feel far more secure now in implementing this as a security option!!!