topic Re: remote root login in Operating System - HP-UX

remote root login

himacs — Tue, 03 Feb 2009 19:11:27 GMT

Hi,

Can anbody tell me how to check remote root login enabled or not?

In solaris we have /etc/default/login file.
We have to uncomment the /dev/console field.

Is ther any way to check the same in hp-ux?

Regards,

Re: remote root login

Steven E. Protter — Tue, 03 Feb 2009 19:20:36 GMT

Shalom,

This is somewhat dependent on connection protocol.

ssh:

http://docs.hp.com/en/5992-3387/ch05s06.html

DCE

http://docs.hp.com/en/5991-7712/ch02s04.html

telnet et al
http://docs.hp.com/en/5992-3387/ch05s01.html

SEP

Re: remote root login

Tingli — Tue, 03 Feb 2009 19:22:13 GMT

For telnet the file is /etc/securetty. For ssh it is /opt/ssh/etc/sshd_conf.

Re: remote root login

himacs — Tue, 03 Feb 2009 19:25:55 GMT

Hi guys

I dont want to any user to use root account on the network.Only thro direct console only root should work.

regards,

Re: remote root login

Tingli — Tue, 03 Feb 2009 19:35:18 GMT

That is right. To block root login from non-console you need to:
1) echo console >> /etc/securetty
2) In file /etc/ssh/sshd_conf, you need to set "PermitRootLogin no"

Re: remote root login

Tingli — Tue, 03 Feb 2009 19:37:27 GMT

Sorry, the file sshd_conf is located in /opt/ssh/etc.

Re: remote root login

himacs — Tue, 03 Feb 2009 19:43:33 GMT

Hi Tinqli,

Thnks for the response.

Can u please brief me about the
echo console>>/etc/security.

Regards,

Re: remote root login

Tingli — Tue, 03 Feb 2009 19:50:32 GMT

Or you can edit the file /etc/securetty. And add a line "console" to the end of the file.

Re: remote root login

himacs — Tue, 03 Feb 2009 19:53:47 GMT

Hi Tinqli,

I didnot find any file named /etc/security and /etc/securetty.Is this default one or we need to create manually?

Regards,

Re: remote root login

Tingli — Tue, 03 Feb 2009 19:58:09 GMT

Here is a link about it:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1233691010179+28353475&threadId=1174327

Re: remote root login

himacs — Tue, 03 Feb 2009 20:12:39 GMT

Hi Tinqli,

Thanks for ur timely response.

As m new in hp-ux, i have some doubts.

/etc/securetty file is default one or manually we need to create?

becuase i didnot find the same in my system.

regards,

Re: remote root login

Patrick Wallek — Tue, 03 Feb 2009 20:25:37 GMT

You must create it.

The easiest way:

# echo console > /etc/securetty

Re: remote root login

Sani — Wed, 04 Feb 2009 07:57:51 GMT

Hi Himacs ,

Through /etc/securetty and /opt/ssh/etc/sshd_conf , you can rstrict direct root login to the server.But at the same time any user can login with his username and switch to root (su -)....

To prevent this you have to add an entry in /etc/default/security file . ie

SU_ROOT_GROUP=group

Now users attempting to su to root must be a memeber of this group .

Thanks