topic Re: etc/securetty in Operating System - HP-UX

etc/securetty

hmorrison — Fri, 08 Sep 2006 11:51:17 GMT

I was wondering if the etc/securetty file contains anything else besides the list of valid ttys for root login. Also, does it mean that if this file does not exist , root can be accessed from anywhere, providing the password is known?

Re: etc/securetty

Patrick Wallek — Fri, 08 Sep 2006 11:58:45 GMT

No, the /etc/securetty file shoud NOT contain anything other than the list of tty's root can log in from.

Yes, if the file does not exist then root can log in from anywhere.

Re: etc/securetty

Victor BERRIDGE — Fri, 08 Sep 2006 12:00:17 GMT

Hi,

All correct, with the only difference that if present, that doesnt mean root cannot access other than...
Understand it is not valid for X windows... (CDE environment)

All the best
Victor

Re: etc/securetty

Patrick Wallek — Fri, 08 Sep 2006 12:01:17 GMT

Oops -- too quick on the submit.

That is why it is recommended that the /etc/securetty file contain a single word: console

That way root can only log in directly from /dev/console, the direct attached console or a web console.

Another thing to think about though is SSH access. Unless your ssh.conf and/or sshd.conf (I can't quite remember) is configured correctly, then root can SSH from one machine to another. Have a look at the ssh.conf and sshd.conf man pages for information on how to restrict that.

Re: etc/securetty

Jaime Bolanos Rojas. — Fri, 08 Sep 2006 12:07:15 GMT

Hmorrison,

From the login man page:

"If the /etc/securetty file is present, login security is in effect, i.e., root is allowed to log in successfully only on the ttys listed in this file. Restricted ttys are listed by device name, one per line. Valid tty names are dependent on the installation. An example is

console
tty01
ttya1
etc.

Note that this feature does not inhibit a normal user from using the su command"

Regards,

Jaime

Re: etc/securetty

IT_2007 — Fri, 08 Sep 2006 12:09:31 GMT

check sshd_config for the following line

#PermitRootLogin no

If it says uncommented and "yes" then root can login through ssh.

Re: etc/securetty

Jaime Bolanos Rojas. — Fri, 08 Sep 2006 12:10:33 GMT

Hmorrison,

Also please do not forget to assign points to people that is taking their time to help you out.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1058052

7 points to 61 responses.

Regards,

Jaime.