topic Re: dual password authentication in Operating System - HP-UX

dual password authentication

Syed Nazer Abbas — Sat, 08 Jan 2011 08:39:58 GMT

Is there any way to implement dual password authentication on root user. like first SA enter password and then Senior SA enter password then we get the root login?. I found this on AIX but dunno if there is such method in HP-UX

Re: dual password authentication

Bill Hassell — Sat, 08 Jan 2011 14:01:19 GMT

The simplest method is to not allow root logins from any location except the console. Do this by setting up /etc/securetty:

echo "console" > /etc/securetty

Now, to attain root login, you must first login as a normal user, then use su - root to login as root. Then restrict the users that are allowed to use su for root login by creating a special group in the /etc/gtorup file, making those selected users members of that group and setting the parameter: SU_ROOT_GROUP equal to that group name. The SU_ROOT_GROUP parameter is added to the file: /etc/default/security. See the man page for security.

Re: dual password authentication

Syed Nazer Abbas — Sun, 09 Jan 2011 04:17:56 GMT

yes that can be implemented in such a way. But thats a work around of the problem. not exactly the solution of the problem

Re: dual password authentication

Manix — Sun, 09 Jan 2011 14:41:39 GMT

Hello Sayed !!

I have seen this at certain client ends where they login on to the server through ssh
i.e user accounts & then use a third party
authentication software like power broker for root access & secure authentication.

I hope sudo is not very safe and recommended
by HP.

not very sure if you are looking at some thing else. i don`t think native OS has this kind of mechanism.

Thanks

Manix

Re: dual password authentication

sarfaraj ahmad — Mon, 10 Jan 2011 05:39:32 GMT

Hi sayed,

there is no feature included in Native HP UX OS for dual authentication of administrator account.

better to go with solution as described by bill and not suggested to use any third party.

Re: dual password authentication

Syed Nazer Abbas — Mon, 10 Jan 2011 05:53:04 GMT

I found RBAC role based authentication on HP-UX. I think that may provide me the features by sudo. Hope one day hp could work on this to provide dual authentication on the ciritical accounts.

However, appreciate all your replies and expert advices and help.

Re: dual password authentication

Syed Nazer Abbas — Mon, 10 Jan 2011 05:54:29 GMT

closing the thread now