topic restrict console login in Operating System - HP-UX

restrict console login

gany59 — Tue, 13 Apr 2010 19:29:29 GMT

how to restrict the root user to login to the console directly. I need to set the limitation like if the user needs to login as root, they must be use the su - root command to switvh as root.

How can we set that one

Re: restrict console login

Steven E. Protter — Tue, 13 Apr 2010 19:33:45 GMT

Shalom,

Read:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1367457

SEP

Re: restrict console login

Kapil Jha — Wed, 14 Apr 2010 03:18:40 GMT

u have to see securetty file

http://www.faqs.org/docs/securing/chap5sec41.html

BR,
Kapil+

Re: restrict console login

Suraj K Sankari — Wed, 14 Apr 2010 04:41:37 GMT

Hi,

The /etc/securetty file allows you to specify which TTY devices the root user is allowed to login on. The /etc/securetty file is read by the login program usually /bin/login. Its format is a list of the tty devices names allowed, and for all others that are commented out or do not appear in this file, root login is disallowed. Disable any tty that you do not need by commenting them out # at the beginning of the line. Edit the securetty file vi, /etc/securetty and comment out the following lines:
tty1
#tty2
#tty3
#tty4
#tty5
#tty6
#tty7
#tty8
Which means only root is allowed to login on tty1. This is my recommendation, allowing root to log in only on one tty device and use the su command to switch to root if you need more. devices to log in as root.

For ssh we need to do like this

echo "PermitRootLogin no ">> /opt/ssh/etc/sshd_config

restart sshd demon

/sbin/init.d/secsh stop
/sbin/init.d/secsh start

Suraj

Re: restrict console login

Horia Chirculescu — Wed, 14 Apr 2010 05:13:31 GMT

In addition to Suraj's post, you should disable telnet (as a general rule) and permit only SSH.

Best regards,
Horia.