topic Re: help with securetty in Operating System - HP-UX

help with securetty

Marie-Josee Cormier — Wed, 14 Feb 2007 12:33:45 GMT

We want to set up securetty to force admins to log with their respective accounts, and then SU to root.

The thing that I don't like, it's with those rp2470, there's no Vga cards, and no console.

Is there a way to simulate a console with those server? Or some work around?

Thanks!

Re: help with securetty

Duncan Edmonstone — Wed, 14 Feb 2007 12:57:42 GMT

Hi,

The rp2470 surely does have a console. See the following link:

http://docs.hp.com/en/rp24xx_basic_cable-en/ch01s04.html#d0e278

If you mean it doesn't have a LAN based console, then yours may not, but as you can see on the link above, you can get a secure web console which will function in the same way.

HTH

Duncan

Re: help with securetty

Steven E. Protter — Wed, 14 Feb 2007 13:01:59 GMT

Shalom,

This system should also have a lan console, which is a RJ45 connector marked as LAN Console.

It can be configured on a network.

SEP

Re: help with securetty

Bill Hassell — Wed, 14 Feb 2007 14:50:15 GMT

All rp-24xx models have two console connections, a serial port for a classic terminal, and a LAN-based console port which is separate from the system LAN port. If you are thinking PC-style or Linux-GUI, there indeed is no VGA or mouse or keyboard nor are they needed. HP-UX, like most commercial Unix flavors, is managed with a command line interface program called a shell. While you can run X11 programs like xterm on HP-UX, the best way is to use a real terminal, or better yet, a secure terminal concentrator (not to be confused with a KVM switch), or by using telnet to the rp's service processor called the GSP. For security, the GSP LAN port should be on a restricted network.

Like any Unix flavor, the console is a low-usage yet critical tool and should be protected but always available when needed. You may want to look at sudo rather than su as a more secure and reliable method to allocate administrator duties. Get sudo from HP at:

http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1111

Select sudo from the Internet Express bundle.

Re: help with securetty

Marie-Josee Cormier — Wed, 14 Feb 2007 15:24:32 GMT

Ah right! : )

The remote console is running.

Now, what do I have to put in the securetty file to allow only login from the Remote Console?

Thanksss! :D:D

Re: help with securetty

Christian Tremblay — Wed, 14 Feb 2007 15:46:43 GMT

one word: console

Chris

Re: help with securetty

Christian Tremblay — Wed, 14 Feb 2007 15:49:13 GMT

PS: the tzupdater tool for Java 1.3 is now available at:

http://www.hp.com/products1/unix/java/DST-US.html

Chris

Re: help with securetty

Marie-Josee Cormier — Thu, 15 Feb 2007 08:25:34 GMT

Yeah, I had it right for the securetty, it was not the problem after all..

I found out that when we have the char "@" in our password, we can't login straight to root. After I changed my password to something without @, works like a charm..

Is this normal behavior?

Thanks again

Re: help with securetty

Bill Hassell — Thu, 15 Feb 2007 09:29:12 GMT

> I found out that when we have the char "@" in our password, we can't login straight to root. After I changed my password to something without @, works like a charm..
> Is this normal behavior?

Very normal. The default settings for a terminal connection is @=cancel line, and #=backspace. This was inherited from the days of teletypewriters (the 'tty' you see throughout Unix communications). The TTY is a paper device so backspacing is not really meaningful, so the # was adopted as the 'previous character delete' or backspace. The @ was virtually unused so it became the line cancel. After you login, there are several stty commands in /etc/profile to set these conditions to other characters (stty erase "^H" kill "^U")

For the first 15 years or so for HP-UX, there was no way to change the defaults prior to login. But starting with patches for 10.20, a new device file now exists that changes the default: /dev/ttyconf. If your system has this devicefile, then you can change the default (see man stty). To set the more standard values:

stty erase "^H" kill "^U" < /dev/ttyconf

The change immediately affects all new logins except the console. This is because the console is opened almost all the time. You can set the ttyconf params in inittab so it will be effective for the console and all other ports at bootup. Modify the "stty" line in inittab from:

stty::sysinit:/sbin/stty 9600 clocal icanon echo opost onlcr ixon icrnl ignpar
to:

stty::sysinit:/sbin/stty 9600 erase "^H" kill "^U" clocal icanon echo opost onlcr ixon icrnl ignpar

Re: help with securetty

Marie-Josee Cormier — Thu, 15 Feb 2007 10:00:28 GMT

yay!! : ) THanks