topic Re: Disable remote root login in Operating System - HP-UX

Disable remote root login

Peng Lu — Mon, 15 Nov 2004 21:49:05 GMT

Hi,

I want to disable remote root login on HPUX 11i hosts. (only allow users login remotely as a normal user then su to root). I have created /etc/securetty file with the content "console". However, I can still remotely login as root through ssh2.

Is ssh handled differently or do I need to reboot after creating /etc/securetty file?

Thanks in advance.
Peng

Re: Disable remote root login

Bill Hassell — Mon, 15 Nov 2004 21:54:03 GMT

Yes, ssh (older versions) do not use PAM for authentication. Download the latest version of OpenSSH from HP at software.hp.com. Alternatively, enable the parameter in your sshd_config file:

sshdPermitRootLogin no

NOTE: This should be mandatory on *ANY* system facing the open Internet. Over the last few months, many, many scripted attacks for ssh have been seen and root is one of several common logins being tested by hackers.

Re: Disable remote root login

Bill Hassell — Mon, 15 Nov 2004 21:57:02 GMT

Almost forgot: the latest version of OpenSSH from HP is 3.71 and the item you need to turn on in sshd_config is:

UsePAM yes

Re: Disable remote root login

Peng Lu — Mon, 15 Nov 2004 22:15:10 GMT

Thanks Bill.

swlist shows my ssh is the following version:
"Secure_Shell A.03.71.000 HP-UX Secure Shell". And in "/opt/ssh/etc/sshd_config" file, "UsePAM" is set to "yes".

Am I looking into the wrong file?

Peng

Re: Disable remote root login

Bill Hassell — Mon, 15 Nov 2004 22:22:38 GMT

I think I remember that /etc/securetty was hardcoded into the login program and not incorporated into PAM. You'll need to use:

PermitRootLogin no

Re: Disable remote root login

Peng Lu — Mon, 15 Nov 2004 22:42:28 GMT

Thanks again Bill.

I set "PermitRootLogin" to "no" and did a "kill -SIGHUP ". It doesn't allow me to ssh login as root. However, instead of a clear message, it still prompts for password. After I put in password, it keeps asking "password for root@:" which is a bit annoying (see below).

password for root@:
password for root@:
password for root@:
password for root@:
password for root@:
password for root@:
password for root@:

Disconnected; protocol error (Too many authentication failures for root).

As you can see, after 7 tries, it finally kicked me off.

Is this the way supposed to be?

Thanks,
Peng

Re: Disable remote root login

Ravi_8 — Tue, 16 Nov 2004 00:31:53 GMT

Hi

#echo console > /etc/securettys
#chmod 0744 /etc/securettys

no need to reboot after creating /etc/securettys file

ssh is given for security, it wouldn't allow direct root login even though /etc/securettys is not exist.

Re: Disable remote root login

Peng Lu — Tue, 16 Nov 2004 00:51:09 GMT

Hi Ravi,

I've already done what you said. See my previous messages.

BTW, ssh does allow you login as root if you don't change configuration.

Thanks anyway.
Peng

Re: Disable remote root login

Bill Hassell — Tue, 16 Nov 2004 07:31:52 GMT

Yes, the ssh daemon does not give you a useful message and keeps denying access several times before closing the connection. The retry (in your case, 7) is set in the sshd_config file with PasswordGuesses. There are two schools of thought on error messages:

1. Provide the reason for authentication failure such as "root login is not allowed"

2. Use the same generic response for all authentication failures such as another request for the password.

In case #1, the sysadmin will know the reason without looking in syslog, but at the same time, provide the hacker with too many details. In case #2, the actual failure (root not allowed, username does not exist, password incorrect, etc) is not given, thus keeping the real reason away from the unauthenticated user. Most security people will choose less information for login attempts. Even Unix will not report whether you failed to type the username or failed to type the correct password, just "Login incorrect"

Re: Disable remote root login

Peng Lu — Wed, 17 Nov 2004 18:24:07 GMT

Thanks Bill.

Looking into sshd_config file, I couldn't find "PasswordGuess" parameter though. Is this something by default no there?

Peng

Re: Disable remote root login

Bill Hassell — Wed, 17 Nov 2004 21:43:18 GMT

Ooops, sorry, that is a keyword for F-Secure's ssh2 product and not part of OpenSSH (I run both products on different servers).