topic Re: Allow login from Console only in Operating System - HP-UX

Allow login from Console only

Juliana Lee — Thu, 25 Jan 2001 16:33:58 GMT

Hello

I followed the following instruction:

# echo console >> /etc/securetty
# chmod 600 /etc/securetty

I couldn't telnet as root but could login as a normal user and "su" as root, however, I am still able to login as root from other terminal. What can I do to disable this?

Re: Allow login from Console only

Patrick Wallek — Thu, 25 Jan 2001 16:36:19 GMT

Here is an ll of my /etc/securetty file:

-r-sr-xr-x 1 root sys 8 Mar 11 1996 /etc/securetty

I don't know if this will make a difference or not, but it's worth a shot.

Re: Allow login from Console only

Dan Hetzel — Thu, 25 Jan 2001 16:38:50 GMT

Hi Juliana,

Make sure your /etc/securetty has one single line.

# echo console > /etc/securetty
# chown root:sys /etc/securetty
# chmod 644 /etc/securetty

This should prevent root logins from all terminals but the system console

Best regards,

Dan

Re: Allow login from Console only

Dan Hetzel — Thu, 25 Jan 2001 17:41:33 GMT

Hi Patrick,

I don't really understand the permissions of your /etc/securetty file.
It shouldn't be marked for execution and surely not SUID....

On all servers we have here it's set to
-rw-r--r-- root sys ........

All the best,

Dan

Re: Allow login from Console only

Juliana Lee — Thu, 25 Jan 2001 19:11:37 GMT

Thanks Guys, I did both of your suggestions

# ll /etc/securetty
-r-Sr-xr-x 1 root sys 8 Jan 25 10:49 /etc/securetty
# cat /etc/securetty
console

# chmod 644 /etc/securetty
# ll /etc/securetty
-rw-r--r-- 1 root sys 8 Jan 25 10:49 /etc/securetty

login and out again, I still can login as root.
I wonder if there is something to do with the dtterm! It seems that the file is not being read.

Re: Allow login from Console only

Dan Hetzel — Fri, 26 Jan 2001 06:25:44 GMT

Hi Juliana,

Are you using OpenSSH ?

In that case, set "PermitRootLogin no" in your sshd_config file and restart the SSH daemon.

Best regards,

Dan