topic Re: securetty functionality for non-root users in Operating System - HP-UX

securetty functionality for non-root users

Dave Parmer — Thu, 09 Oct 2003 16:05:24 GMT

I have a requirement to implement securetty functionality for the "oracle" account. Our auditors want to restrict access to the account except from a "user" account and the su command. That way we could use the sulog to trace which real users where logged in as "oracle". Any ideas on how to do this?

Re: securetty functionality for non-root users

Robert-Jan Goossens — Thu, 09 Oct 2003 16:25:56 GMT

Hi,

Think you are looking for this solution.

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0x7924cbaac6dcd5118ff40090279cd0f9%2C00.html&admit=716493758+1065734732126+28353475

Hope it helps,

Robert-Jan.

Re: securetty functionality for non-root users

Michael Steele_2 — Thu, 09 Oct 2003 16:50:17 GMT

If you add 'console' to /etc/securetty then root can log in only at the console.

So securetty is used to restrict root access only and has no relation to other login accounts.

What you're describing is what the 'last' command is for.

# last account
# last -b account
# last -R account

You can also restrict 'rlogins', force all to use 'telnet' and track in syslog.log. Add -l to /etc/inetd.conf:

telnet stream tcp nowait root /usr/sbin/in.telnetd in.telnetd -l

You can also look into /sbin/init.d/acct, system accounting, but this is usually reserved for expense charging for time.

Re: securetty functionality for non-root users

Keith Bevan_1 — Fri, 10 Oct 2003 10:31:04 GMT

The /etc/securetty file is used to restrict root access. The single entry in the file determines where root can login,but not necessarily where people can su upto root.

Typically the contents of this file would read :-

console

So the root account can only be logged in from the console.

Please note the /etc/securetty file does not prevent a user from using the root login if that user is using something call CDE (Common Desktop Environment). In this case you must edit the file /etc/dt/config/Xstartup to contain the following :-

if [ $USER = root ] ; then
exit 1
fi

The other option if using CDE is to cp the file usr/dt/config/Xstartup to /etc/dt/config/Xstartup.

An additional security measure is to setup an su group to allow only a certain number of people to su to root. This can be achieved by creating an entry in /etc/default/security :-

SU_ROOT_GROUP=groupname

where groupname corresponds to the name of the group in /etc/group file that should be allowed to use su to root. Root does not need to be a member of this group !

Hope this helps.

Keith

Re: securetty functionality for non-root users

Dave Parmer — Fri, 10 Oct 2003 10:42:25 GMT

Thanks for the input. The changes to the profile did the trick.