topic Re: changing /dev/console permissions in Operating System - HP-UX

changing /dev/console permissions

Kevin Bushman — Mon, 08 Nov 2004 16:26:23 GMT

All,
Due to security requirements, I would like to change the permissions on /dev/console so it is not world writable when someone is logged in on the console (especially root). I've searched here and found a couple of ideas that didn't work.

I've checked two different systems where on one this works and on the other it doesn't and there are no differences on the file permissions when either logged in on the console or not logged in (when logged in they're the same on both, when not logged in they're the same on both).

I've also looked at the idea of changing the group ownership of /dev/console to sys, but on the system where this works, this isn't how it was done either.

Any suggestions? I've been all through the processes and can't find any way of implementing this. I could program it somehow, but would rather not if someone has a better solution.

TIA...

Gonzo

Re: changing /dev/console permissions

Steven E. Protter — Mon, 08 Nov 2004 16:36:16 GMT

This kind of /etc/profile code may work:

if [ "$chkname" = "root" ]
then
echo "..........."
else
# echo "making the terminal file secure from hackers."
mesg n >/dev/null
fi

if [ "$LOGNAME" = "root" ]
then
echo "Native root login. Securing the terminal file."
mesg n >/dev/null
fi

# just change the device.

SEP

Re: changing /dev/console permissions

A. Clay Stephenson — Mon, 08 Nov 2004 16:43:03 GMT

The permissions are set to 622 as part of the normal console login. Normally write permission is not considered to be a security risk because even if the root user (logged in at the console) saw "Please enter root password for verification" and were dumb enough to respond unless a process had read access to that port no damage would be done. You should also be aware that some daemons which might not be run as root) might write error messages to the console. One option would be to modify root's .profile and if connected to /dev/console determined by "who am i" then set the port permissions but this is really not a risk.