topic Re: Console login in Operating System - HP-UX

Console login

muthamilan — Sat, 16 Aug 2003 09:23:38 GMT

hi friends
Once again i need your help.i'm having hp-ux 11.In my HP-UX 11 console i can login as a root,but user id can't login on console.I think in hpux 10.20 remove /etc/securetty file then user can login on console.In hpux 11 what can i do?kindly guide me friends.

Thanks and Regards
S.Muthu

Re: Console login

Michael Tully — Sat, 16 Aug 2003 09:39:45 GMT

HPUX 11 uses the same concept for logging in at the console for root. Yes remove /etc/securetty but you must be root in order to do so. Is a user account locked out?
If the system is trusted you can unlock an account by using

# /usr/lbin/modprpw -k

Re: Console login

Keith Bevan_1 — Sat, 16 Aug 2003 09:49:18 GMT

Hi,

/etc/securetty still works on HPUX 11.

creating a zero length file called /etc/securetty will prevent the root account from being accessed directly from any terminal line (including the console).

However the users can still use the console for other logins and use su from their own account in the unlikely event that they know the root password.

Keith

Re: Console login

muthamilan — Sat, 16 Aug 2003 09:54:38 GMT

Hi Michael

But i didn't see /etc/securetty file on my hpux11.but user can't able to login in console.
root user only able to login on console.

Re: Console login

Michael Tully — Sat, 16 Aug 2003 11:15:39 GMT

what if any messages are being received by the user when they try to login? This might help us identify the problem. Is this account being used by an operator or the like??

Re: Console login

Keith Bevan_1 — Sat, 16 Aug 2003 11:37:17 GMT

Hi,

One additional item to check is :-

Do you have the file /var/adm/inetd.sec

If so review its contents in relation to the advice and usage detailed on the man page inetd.sec.

Keith

Re: Console login

muthamilan — Sat, 16 Aug 2003 13:05:25 GMT

hi friends
while user login on console then no error message.that time system once again goto authentication menu i.e., once again ask user name and password.if i give root user id and password then it will goes normally.
i didn't see /var/adm/ined.sec* files.
kindly guide me friends.

Re: Console login

Rainer von Bongartz — Mon, 18 Aug 2003 05:48:34 GMT

Is this a trusted system ????

If yes check to see if there is a line

console:t_devname=console:t_maxtries#777:chkent:

in /tcb/files/ttys

Regards
Rainer

Re: Console login

muthamilan — Mon, 18 Aug 2003 06:04:26 GMT

Dear Rainer
No it's not trusted system.

Thanks and Regards
S.Muthu

Re: Console login

Massimo Bianchi — Mon, 18 Aug 2003 07:38:24 GMT

Hi,
i suspect an hand-made security.

login from the console and check all the
/etc/profile
.profile
.login

to see if there is a check against the tty.

i thik of a user exit to prevent root from logging in..

Massimo

Re: Console login

yogesh_4 — Mon, 18 Aug 2003 07:51:24 GMT

Dear Muthu ,

/etc/securetty is not generated bydefault when system is getting installed. We have to create it manually. Also in your case just check whether /var/adm/inetd.sec file exists and any login is restricted in that. Also whether this is happening only from console or for telnet also other nonroot users can not login ?

Re: Console login

Kelli Ward — Mon, 18 Aug 2003 12:31:13 GMT

Hi,
One annoyingly simple thing that got me once for a little while, no world read permissions for the /etc/hosts file.
You might want to check, just to be sure.
Good luck,
Kel