topic Re: Telnet and root in Operating System - HP-UX

Telnet and root

Stefano_65 — Mon, 10 Jan 2005 04:42:52 GMT

Hi everybody,
I need to deny a direct access of some users (root, oracle) via telnet, force them to login as different user and using su.
Logins are not restricted to specific hosts.

Any suggest?

thanks.

s.

Re: Telnet and root

Robert-Jan Goossens — Mon, 10 Jan 2005 04:50:02 GMT

Hi Stefano,

For root it is easy.

Create a file called /etc/securrety
# echo console > /etc/securetty
# chmod 400 /etc/securrety

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x7924cbaac6dcd5118ff40090279cd0f9,00.html

Best regards,
Robert-Jan

Re: Telnet and root

Stefano_65 — Mon, 10 Jan 2005 05:22:04 GMT

Ok for root access.
Now, I'va a new question: I want to allow su - root only for some users.. Can I do this?

Thanks again!

s.

Re: Telnet and root

Fred Ruffet — Mon, 10 Jan 2005 05:37:08 GMT

When using su, user displayed by "who -m" is always the user who first issued telnet to the host. You can then in root's .profile get result of this command and compare to a valid user list (only readable and writable by root).

Regards,

Fred

Re: Telnet and root

Robert-Jan Goossens — Mon, 10 Jan 2005 05:41:48 GMT

Hi Stefano,

Check this doc.

How can one keep users from running the su(1) command, yet still allow
a couple of users to be able to do this?
RESOLUTION
This feature is available via the SU_ROOT_GROUP parameter on HP-UX 11.11
and HP-UX 11.00 with the following patch installed:

PHCO_15232 s700_800 11.00 su(1) cumulative patch
The current version is PHCO_16127.

http://www4.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000076457542

Hope this helps,
Robert-Jan

Re: Telnet and root

Michael Selvesteen_2 — Mon, 10 Jan 2005 05:45:24 GMT

Yes you can restrict 'su' for certain users
by specifying in

/etc/default/security

man security shows:

SU_ROOT_GROUP

This parameter defines the root group name for the su
command. Refer to su(1).

SU_ROOT_GROUP=group_name The root group name is set to
the specified symbolic group name. The su command
enforces the restriction that a non-superuser must be a
member of the specified root group to be allowed to su
to root. This does not alter password checking.

Default value: If this parameter is not defined or if
it is commented out, there is no default value. In
this case, a non superuser is allowed to su to root
without being bound by root group restrictions.

Hope this helps

--
M

Re: Telnet and root

Stefano_65 — Mon, 10 Jan 2005 05:48:25 GMT

thanks everybody!