topic Disable root rlogin in Operating System - HP-UX

Disable root rlogin

Henry Nguyen — Mon, 12 Jul 2004 12:20:31 GMT

Hello All:

Is there a way to disable rlogin for root, but allow all the r* services enable(ie. rcp, remsh...) for root. I have already set up an /etc/securetty file to force root login only from the console. I would configure the /var/adm/inetd.sec file, but this would disable rlogin for everyone. I'm only interested in disable rlogin for root. Any advice is appreciated.

Thanks,
Henry

Re: Disable root rlogin

RAC_1 — Mon, 12 Jul 2004 12:29:07 GMT

TCP wrappers.

Check /etc/hosts.allow and /etc/hosts.deny

Anil

Re: Disable root rlogin

Hai Nguyen_1 — Mon, 12 Jul 2004 12:40:13 GMT

That's not true. With /var/adm/inetd.sec, you can specify a user ID which you want to deny a service. Man inetd.sec for an example.

Hai

Re: Disable root rlogin

RAC_1 — Mon, 12 Jul 2004 12:44:03 GMT

Henry,

There is no way, you can do that with inetd.sec. If is for rejecting/allow service to a host/network

Your only option seems to be tcp wrappers.

Anil

Re: Disable root rlogin

Jeff Schussele — Mon, 12 Jul 2004 12:53:28 GMT

Hi Hai,

I have to agree w/RAC on this one.
With inetd.sec granularity can only go down to hostname/IP as well as subnet.
With tcp-wrappers you *can* go down to username - like:
username@hostname.com

Henry - I believe that's the only way you can do this short of some code in /etc/profile that will query access method as well as login name to disallow root rlogins.

tcp-wrappers cab be had here:

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcp_wrappers-7.6/

highly recommended.

Rgds,
Jeff

Re: Disable root rlogin

Hai Nguyen_1 — Mon, 12 Jul 2004 14:05:14 GMT

Jeff and RAC,

You are both right. My bad for believing my memory with reviewing the man page. Henry, inetd.sec cannot handle this. Sorry for my mistake.

Hai

Re: Disable root rlogin

Simon Wickham_6 — Tue, 24 Jan 2006 04:51:37 GMT

Hi,

Have you checked /etc/inetd.conf and run inetd -c to pick up the changes if required. Also ensure no TCP wrappers by checking if you have a /etc/hosts.allow and /etc/hosts.deny.

It also worth checking /var/adm/inetd.sec for any entries.

Regards,
Simon

Re: Disable root rlogin

Muthukumar_5 — Tue, 24 Jan 2006 05:01:05 GMT

Yes. You can simply make in /.profile file.

/.profile

ps | grep -q 'rlogind'
if [[ $? -eq 0 ]]
then
echo "ERROR: rlogin with root account is disabled"
sleep 2
exit 1
fi

Note: remsh is like rlogin

It is working.

--
Muthu