topic Removing direct root access in Operating System - HP-UX

Removing direct root access

Adam Noble — Thu, 02 Oct 2003 08:02:28 GMT

We are in the process of tightening up security on a number of HP systems. We intend to remove direct root access to the system and are looking at the best way of doing this. Obviously we will still need to log into the console as root, however the intention is for users to su to root once on the system.

Re: Removing direct root access

Francis_12 — Thu, 02 Oct 2003 08:05:29 GMT

Hello,

/etc/securetty

If the /etc/securetty file exits, root user is only allowed to login in the tty's listed in this file.

Normally, you allow root logins ONLY at
the console. On all other logins must be logged in using user's own id's. If they are needing root priviledge, they will have to su -.

Now, that user needs to do su's to become root, all su's are logged in
/var/adm/sulog.

To do this, create /etc/securetty with only the console entry.

Hope this helps,

Francis DERDEYN - HP-UX ASCE.

Re: Removing direct root access

Jeff Schussele — Thu, 02 Oct 2003 08:06:01 GMT

Hi Adam,

You do this by creating the following file
/etc/securetty
and placing one word in it
console

Then set perms to 400 (-r--------) & ownership to root:sys

HTH,
Jeff

Re: Removing direct root access

Brian Bergstrand — Thu, 02 Oct 2003 08:07:29 GMT

Add 'console' to /etc/securetty.

Then root will only be allowed to login directly via the console.

HTH.

Re: Removing direct root access

Stuart Abramson_2 — Thu, 02 Oct 2003 08:09:33 GMT

vi /etc/securetty
add:
console

This prevents rlogins of form:

rlogin host -l root

but still allows root logins from other hosts with entries in $ROOT_HOME/.rhosts

Re: Removing direct root access

Adam Noble — Thu, 02 Oct 2003 08:18:33 GMT

thanks all!

Re: Removing direct root access

Francis_12 — Thu, 02 Oct 2003 08:20:01 GMT

Hello back again,

There is still something missing here :-)

/etc/securetty is not checked if your users are going to try to log in via CDE. The reason is that /etc/securetty "lists the valid ttys for root login". Since CDE does not use a tty to login the /etc/securetty
has no effect !!

To bypass that limitation, you will need to modify the /etc/dt/config/Xstartup to disable
root console login via CDE.

You might also be interested to use the file /usr/dt/config/Xaccess which restricts external CDE access based on host(IP).

Hope this helps, Bye.

Francis DERDEYN - HP-UX ASCE.

Re: Removing direct root access

Adam Noble — Thu, 02 Oct 2003 09:10:58 GMT

Actually does anyone know of any further restrictions you can make i.e on AIX you can restict a certain group of users to be able to login as root and also I believe you can prevent people logging into ftp as root.

Re: Removing direct root access

Francis_12 — Thu, 02 Oct 2003 09:19:51 GMT

Hi back again,

To secure FTP, go here :

http://www.newfdawg.com/SHP-FTP-ftpaccess.htm
and here :
http://www.newfdawg.com/SHP-FTP-ftphosts.htm

Hope this helps, Bye.

Francis DERDEYN - HP-UX ASCE.