topic Re: root login at console in Operating System - HP-UX

root login at console

Suresh M S R_1 — Fri, 19 Dec 2003 02:11:40 GMT

hi

i have a hp box running hpux 10.20 in trusted mode, as part of security we blocked root login frim terminals , but now i am not able to lgin as root from console also, can anybody help me in this

regards
Rajeev

Re: root login at console

Elmar P. Kolkman — Fri, 19 Dec 2003 02:12:58 GMT

Have you tried to su to root from a normal user?
/etc/securetty is probably your problem. But first test the su, then solve your problem.

Re: root login at console

Suresh M S R_1 — Fri, 19 Dec 2003 02:16:09 GMT

hi

thanx for your replay, i am able to login using su . but a want to login directly as root from consol

thanx
rajeev

Re: root login at console

Michael Tully — Fri, 19 Dec 2003 02:21:17 GMT

What message(s) if any are you getting when you attempt to login from the console ?

Re: root login at console

Suresh M S R_1 — Fri, 19 Dec 2003 02:24:22 GMT

hi

i am getting "login incorrect" mesg from consol as well as from other terminals.

thanx
rajeev

Re: root login at console

Elmar P. Kolkman — Fri, 19 Dec 2003 02:45:26 GMT

Check out /etc/securetty
It should contain console.

echo console >/etc/securetty
chmod 400 /etc/securetty

Re: root login at console

Hoefnix — Fri, 19 Dec 2003 02:51:30 GMT

Check also the contents from the file:
/tcb/files/devassign

Also check manpage of devassign.

Regards,

Peter

Re: root login at console

Suresh M S R_1 — Fri, 19 Dec 2003 03:27:31 GMT

hi

thanx for the suggestions ,i will check this and get back to u

thanx
rajeev

Re: root login at console

Umapathy S — Fri, 19 Dec 2003 05:04:36 GMT

Suresh,
As said previously, /etc/securetty is the problem. For the entries in that file, direct root login is allowed. Make sure that it is not null.

HTH,
Umapathy

Re: root login at console

Keith Bevan_1 — Fri, 19 Dec 2003 08:08:23 GMT

Rajeev,

The special file to restrict the location & use of the root account is :-

/etc/securetty

This file should have the permissions
-rwx------ , owned by root and group sys.

If you view this file whilst logged in as root or su from another location :-

pg /etc/securetty

it should contain the word console if you want to login as root from the console.

Additional info:

If you are using CDE (Common Desktop Environment) then make sure that console use is also not restricted in the following file :-

/etc/dt/config/Xstartup

Hope this helps.

Keith

Re: root login at console

RAC_1 — Fri, 19 Dec 2003 08:16:28 GMT

If your password have special chars in it, (such as @ etc.)you may have problem logging in from console as root.

For a while mv /etc/securetty to /etc/securetty.bak.

Now telnet to machine and try loggin in with root. If this is working, try logging in from console as root, if you still get error, and you have special char in password, then change it(do not use special char)and try.

Re: root login at console

Elmar P. Kolkman — Fri, 19 Dec 2003 09:12:36 GMT

Anyone tried using a -B in root's passwd? ;-)

Re: root login at console

Kent Ostby — Fri, 19 Dec 2003 10:36:49 GMT

Elmar --

How about cntl-bRS in the password :-)

Re: root login at console

Suresh M S R_1 — Mon, 22 Dec 2003 00:00:08 GMT

hi

the problem was with /etc/securetty only. i moved that file as securetty.org,then i am able to login as root. but when i added console in that file , login incorrect mesg is coming in console also , pls help

thanx
rajeev

Re: root login at console

Patrick Wallek — Mon, 22 Dec 2003 00:04:40 GMT

Do you have just the word 'console' in the file?

# cat /etc/securetty
console
#

If you have something like /dev/console then it will not work.

Re: root login at console

Suresh M S R_1 — Mon, 22 Dec 2003 00:10:32 GMT

hi

i have inserted console in that file, and /dev/console is also there in the mechine.

than
rajeev

Re: root login at console

Suresh M S R_1 — Mon, 22 Dec 2003 00:37:19 GMT

hi

so how can i restrict root to be accessed only from console, pls help

thanx
rajeev

Re: root login at console

ConnieK — Mon, 22 Dec 2003 09:14:42 GMT

Rejeev,

I have a feeling that the root account has been disabled. If you are attempting to log in at the console with VUE/CDE and this message appears, open up a terminal session instead of CDE. In other words, go to the console, right-click the button that says "Start Over". A drop-down menu will appear. Select the one that says "No Windows" and hit return. You should see a shell login prompt where you can login as root. This should correct your problem.

Connie K.

Re: root login at console

Bill Hassell — Mon, 22 Dec 2003 10:39:34 GMT

The securetty file CANNOT have a fullpath such as /dev/console. It must only have the word console. The security module prepends the word(s) in securetty with /dev/ so if you have /dev/console, then the 'approved' device is: /dev//dev/console and that will fail. Since you can use su, the root account is OK. I would start all over with your /etc/securetty file (in case there are special characters hidden in the problem file):

echo console > /etc/securetty

That should fix it.

Re: root login at console

Suresh M S R_1 — Tue, 23 Dec 2003 00:01:33 GMT

hi all

thanx for your help , i added console in /etc/securetty using echo consloe > /etc/securetty and changed permissions to
-rwx------ , owned by root and group sys.

After this i restarted the mechine , it worked !!!!!!!

now i am able to login as root only from consloe

thanx again to all of u for the help

Rajeev