topic Re: blocking root access from a telnet session in Operating System - HP-UX

blocking root access from a telnet session

Bob_16 — Wed, 23 Oct 2002 22:51:54 GMT

i want to block root access from a telnet session. the admin must be at the console to login directly as root. however i want to telnet with a valid username, then execute su to root when needed.

is there a console=/dev/console parameter i could set for this?

thanks

Re: blocking root access from a telnet session

Jeff Schussele — Wed, 23 Oct 2002 22:58:58 GMT

Hi Bobby,

Create a file in /etc called

securetty

And in that file place the word

console

And only that word.
Then set perms on /etc/securetty to

-r--r--r-- root:sys

This will allow root logins ONLY from the console

Rgds,
Jeff

Re: blocking root access from a telnet session

Michael Tully — Wed, 23 Oct 2002 23:03:33 GMT

Sorry, the permissions should be '400' we don't want write permissions, and only 'root' should be able to read it.

Re: blocking root access from a telnet session

Michael Tully — Wed, 23 Oct 2002 23:05:11 GMT

Hi,

What your looking for is to have root only login directly from the console.

# echo "console" >>/etc/securetty; chmod 700 /etc/securetty ; chown root:sys /etc/securetty

You might wish to invest some time into installing 'sudo' as well. You can get it from here: http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.6/

HTH
Michael

Re: blocking root access from a telnet session

Bob_16 — Wed, 23 Oct 2002 23:22:55 GMT

thanks! for the quick response, that's amazing.

i've set this up on a test box, and it does what i want. too bad hp-ux doesn't convey a message like solaris stating you are not at a console, but i can live with that.

thanks again.

Re: blocking root access from a telnet session

Jeff Schussele — Wed, 23 Oct 2002 23:39:13 GMT

That's amazing Michael!
You corrected yourself before you even answered =~)

Hee..hee..hee,
Jeff