topic Re: Restricting root login from CDE in Operating System - HP-UX

Restricting root login from CDE

sheevm — Mon, 05 Aug 2002 17:22:45 GMT

Hi!

I like to restrict root login from the terminals. Users come to the unix box through exceed and CDE.

Telnet from the unix to unix box is working fine. Users have to do su - root to logon as root from the terminals. But if they connect from CDE it lets them login as root.

Does anyone out there guide me how to make this work? HP-UX 11.00

Thanks in advance

Re: Restricting root login from CDE

Sanjay_6 — Mon, 05 Aug 2002 17:26:54 GMT

Hi Raji,

Take a look at this thread,

http://support1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000045437203

The Doc id is KBRC00000074

Hope this helps.

Regds

Re: Restricting root login from CDE

harry d brown jr — Mon, 05 Aug 2002 17:27:10 GMT

try this thread:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x09c1119c3420d411b66300108302854d,00.html

or this

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x99d8a135f587d5118ff00090279cd0f9,00.html

Search string used: restricting root logins cde

live free or die
harry

Re: Restricting root login from CDE

Sanjay_6 — Mon, 05 Aug 2002 17:29:45 GMT

Hi Raji,

Or you can try this thread,

http://support1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000052479472

The doc id is S3100000413

Hope this helps.

Regds

Re: Restricting root login from CDE

MANOJ SRIVASTAVA — Mon, 05 Aug 2002 17:36:13 GMT

Hi Raji

What we do is like that . Edit /etc/profile and put the folliwing lines :

loginid=`who am i | awk '{print $1}'`

echo $loginid
if [ $loginid = root ]
then
exit
fi

this will disable any logins to root , and then all users will ahve to login as non root and tehn su to root.

Manoj Srivastava

Re: Restricting root login from CDE

sheevm — Mon, 05 Aug 2002 17:58:18 GMT

Hi Manoj:

I tried what you are saying but when I did su - root also failed to login. Does "su" also executes /etc/profile. But I tested it for $LOGNAME.

Raji

Re: Restricting root login from CDE

MANOJ SRIVASTAVA — Mon, 05 Aug 2002 18:04:38 GMT

Raji

the trick is that

whoami and id are differtn things so if you login as root /etc/profile will set the value of loginid as root and throw you out , however if you login as raji it will set the value of loginid as raji and will not throw you out bcoz the id is not root , so no one can login as root and to login as root you need to su to root.

This will be true for console too as /etc/profile is excuted when u do a su also .

Manoj Srivastava

Re: Restricting root login from CDE

Tom Dawson — Mon, 05 Aug 2002 18:22:46 GMT

Raji,

Remember, there is a difference between "su - root" and "su root". If you execute "su root", /etc/profile does not get executed.

HTH,
Tom

Re: Restricting root login from CDE

Niraj Kumar Verma — Tue, 06 Aug 2002 03:26:24 GMT

Try this

Put this into your /etc/profile

uid=`id -u`

if [ $uid -ne 0 ]
then
echo "You are not Authorised to Login"
sleep 5
exit 0
fi

Regards
-Niraj