topic Re: After setup /etc/securetty file, generating message in Operating System - HP-UX

After setup /etc/securetty file, generating message

Byun Hee Joong — Mon, 29 Jun 2009 01:16:39 GMT

I setup /etc/securetty file to inhibit access as root user.

I want to generate information message when the user try to login with root user.

It's just a sample message.
"The root user is prohobited to login.
You must login with other users."

How can I generate above message?
Thanks in advance.

Re: After setup /etc/securetty file, generating message

Matti_Kurkela — Mon, 29 Jun 2009 09:20:33 GMT

The standard /usr/bin/login does not have the facilities to create customized rejection messages.

Instead, you might use /etc/issue (for serial-attached terminals) or banner files (for network connections; see the man page of your network connection server daemon) to announce this to *everyone* logging in.

If the server knows in advance that an authentication attempt is inevitably going to fail (i.e. the user chose the username "root"), it is more secure to allow the user to go through the motions of the standard authentication procedure and *then* kick the user out, *without* telling him/her exactly what was wrong.

This way a potential intruder cannot gather information on what is allowed and what isn't, and may spend some time making useless attempts. That allows the sysadmin more time and evidence to detect the intrusion attempt.

MK

Re: After setup /etc/securetty file, generating message

Steven E. Protter — Mon, 29 Jun 2009 09:46:15 GMT

Shalom,

I would use /etc/issue as well.

Or not use /etc/securetty and build some code into /etc/profile to display the message.

/etc/issue and your current changes is the most secure way to prevent direct root login.

You might also try public key only ssh login for root, it is very secure and convenient for administrators.

http://www.hpux.ws/?p=19

SEP