topic Re: User log as Root in Operating System - HP-UX

User log as Root

meekrob — Thu, 26 Jul 2007 08:42:21 GMT

Hi all ,
I want to know and to register the users that log on a HP9000 HPUX system ,
i have users that i don't want that they log as ROOT directly through telnet , i need them to log as their users and then do su - and log as root so i can identify them ,
so how can i block a user to log as root directly when promt to login ,
note that all these connections are done through telnet or ssh ,

Re: User log as Root

Robert-Jan Goossens — Thu, 26 Jul 2007 09:16:14 GMT

Hi,

Simple answer, create the file /etc/securetty with the word console in it. Now root can only direct login from the console.

# echo console > /etc/securetty

Regards,
Robert-Jan

Re: User log as Root

Bill Hassell — Thu, 26 Jul 2007 11:06:37 GMT

The second solution is better: download and install the sudo package. That way, users can be given SOME root privileges and will never need to know the root password.

Re: User log as Root

Aussan — Thu, 26 Jul 2007 11:46:34 GMT

put console in securetty to block direct telnet login as root

# echo console >> /etc/securetty

and add a group to the security file

in /etc/default/security

SU_ROOT_GROUP=mygroup

then the users who you want to su as root add them to mygroup, and they will be the only ones allowed to su as root

Re: User log as Root

Heironimus — Thu, 26 Jul 2007 12:15:03 GMT

sshd uses the configuration directive "PermitRootLogin" in sshd_config for allowing or denying root logins via ssh. You need this in addition to /etc/securetty.

Re: User log as Root

Rahul Kumar Gupta — Wed, 01 Aug 2007 09:18:35 GMT

Can u tell me abt this sudo package, from which site i can get it.

thnx

Re: User log as Root

Robert-Jan Goossens — Wed, 01 Aug 2007 09:20:39 GMT

Hi Rahul,

Sudo is available for 11.11,11.23 and 11.31 from

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.8p12/

Regards,
Robert-Jan

Re: User log as Root

Geoff Wild — Wed, 01 Aug 2007 12:19:24 GMT

For root history, we add the following in .profile so that each admin has their own history file - kind of a mini audit as well:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
date >>$HISTFILE
export HISTFILE
HISTSIZE=5000
export HISTSIZE

Rgds...Geoff