topic Blocking Root telnet in Operating System - HP-UX

Blocking Root telnet

Raghuram Ollakal_1 — Sun, 11 Nov 2001 13:18:47 GMT

I would like to know in HPUX is there a way I can block telneting to server as " root" other than a user. I know in Sun Solaris I can block telneting as root.

Re: Blocking Root telnet

Patrick Wallek — Sun, 11 Nov 2001 13:24:19 GMT

To keep someone from logging into the box directly as root from anywhere EXCEPT the console create the file /etc/securetty
and put the word

console

into the file.

# cat /etc/securetty
console
#

This will allow root to login directly from the console only. If a user has the root password, however, the user can login as him or her self and then do an 'su -' put in the root password and be logged in.

Re: Blocking Root telnet

David Lodge — Sun, 11 Nov 2001 13:41:02 GMT

Note the above will *only* stop telnet and IIRC rlogin. If you require to stop root logging in via other mechanism (eg ftp, ssh, xdm) then you have to configure those bits seperately.

FTP is easy - just put the word root in the /etc/ftpd/ftpusers file.

To stop root in xdm you have put a little scriptlet in the xstartup file...

Re: Blocking Root telnet

Bill Hassell — Mon, 12 Nov 2001 03:35:37 GMT

One additiobnal note: You can eliminate root from logging in from ANY source with:

cat /dev/null > /etc/securetty

Now this might seem to be a bit extreme, it is actually a useful mode. It means that anyone that needs root capability must supply 4 pieces of information: two logins and two passwords. In other words, only su will work to attain root user login.

NOTE: Never use su by itself...always, always use su - (that's a trailing minus character) to ensure that root will run /etc/profile and .profile rather than inheriting an unsecure environment.

Re: Blocking Root telnet

Uday_S_Ankolekar — Mon, 12 Nov 2001 03:43:10 GMT

hi,

Insert word 'console' in /etc/securetty file
By doing this you can login as your username only.. If you want root previlage you can do su once you login.

Goodluck

-USA..