topic Re: Disable root telnet access in Operating System - HP-UX

Disable root telnet access

Andy Wu_2 — Wed, 14 May 2003 17:24:42 GMT

How do I disable root telnet access in HPUX 11i?

Is there a similar file like securettys for True64 to disable root telnet access?

Thanks
Andy

Re: Disable root telnet access

David Child_1 — Wed, 14 May 2003 17:26:43 GMT

Andy, yes there is:

just enter 'console' in /etc/securetty and root will not be able to telnet to the server.

David

Re: Disable root telnet access

Patrick Wallek — Wed, 14 May 2003 17:27:39 GMT

Yes, there is. Create a file called /etc/securetty and put the word console in it.

# cat /etc/securetty
console

That will prevent root logging in directly from anywhere but the console. It will allow you to log in via telnet as a regular user and, if you know the root password, do a 'su -' to get to root.

Re: Disable root telnet access

John Poff — Wed, 14 May 2003 17:28:01 GMT

Hi Andy,

You can create a file named /etc/securetty in HP-UX and put the valid ttys where root can login from. Normally you will just put in 'console' and then root can only login at the console.

See the man page for 'login' for more information about securetty.

JP

Re: Disable root telnet access

S.K. Chan — Wed, 14 May 2003 17:28:13 GMT

Simply create a file called /etc/securetty (perm=440) and put the line
console
in it. That would ONLY allow root login from the console.

Re: Disable root telnet access

Andy Wu_2 — Wed, 14 May 2003 17:35:22 GMT

David,

Duh... Thinking that if the file wasn't there, it couldn't be done that way.

Thanks for the quick reply!!

Andy

Re: Disable root telnet access

Bill Hassell — Wed, 14 May 2003 22:55:25 GMT

One additional 'feature' for securetty: if the file is empty, then no one can login as root through any channel (LAN, serial, modem, etc). Pretty secure, eh? Actually, this is a useful setting...any user can use su to become root, thus requiring two successful logins to become root, and with sulog, a good audit trail of who, when and where su was run.