topic Re: Login as root in Operating System - Linux

Login as root

peterchu — Fri, 20 Feb 2004 01:06:02 GMT

In our system , the root can't login directly , it can only login as gerenal user then "su" to root , how to make the root user can login directly ? thx.

Re: Login as root

Mark Grant — Fri, 20 Feb 2004 02:44:45 GMT

Remove /etc/securetty or add all the terminals that you want root to be able to log in from.

This file contains a list of terminals root can log on to.

Re: Login as root

peterchu — Fri, 20 Feb 2004 02:54:24 GMT

thx reply , for the second method , I want my pc can login as root through the telnet function , what terminaal that I should add to ? thx.

Re: Login as root

Mark Grant — Fri, 20 Feb 2004 03:01:34 GMT

This might get a bit irritating for you and isn't particularly secure but you have to add all the "pseudo" tty's that you are likely to use. If you only have a few users then it's not so bad though.

You could start off by adding these

pts/0
pts/1
pts/2
pts/3
pts/4
pts/5
pts/6
pts/7

If you find you run out and you can't log in, just add more of them.

To find out what tty you are currently using run "tty". However, you may well get a different pseudo tty each time you connect. You just have to add all of the ones you are likely to use.

Re: Login as root

PVR — Fri, 20 Feb 2004 04:43:53 GMT

Don't do this. This is not at all advised.

edit /etc/securetty and add
pts/0
pts/1

Re: Login as root

Sunil Sharma_1 — Fri, 20 Feb 2004 04:48:11 GMT

This si an extra layer of security. Please bear with this it will help you if somebody will play with your system.

even if you want to login as root from PC put the entries in /etc/securtty file.

Sunil

Re: Login as root

Alexander Chuzhoy — Fri, 20 Feb 2004 08:03:24 GMT

I'd go with Mark Grant's advise rather than PVR's since if (for example) you use X and open a terminals there - then each terminal would occupy respective /dev/ptsX and you may simply run out of the permitted terminals .To see who's logged and where use the w command.
As for security -since you do enable telnet not to mention for root-I understand that the security is not the issue here.

Re: Login as root

Paul Cross_1 — Fri, 20 Feb 2004 13:39:27 GMT

Just wanted to add 2 cents to the security thread here. I don't see how logging in with telnet as userx and running "su - root" is more secure than logging in directly as root. Someone snooping your network is going to get your passwords regardless.

Re: Login as root

Olivier Drouin — Fri, 20 Feb 2004 14:36:58 GMT

If you use SSH

/etc/ssh/sshd_config
PermitRootLogin yes

Re: Login as root

Martin P.J. Zinser — Fri, 20 Feb 2004 21:22:21 GMT

You really should have a look at ssh for root logins. It gives you all that telnet does, but since the password is sent encrypted it is much more secure.

Basic usage: ssh root@

Greetings, Martin

Re: Login as root

Mark Travis — Fri, 20 Feb 2004 22:09:30 GMT

pcross --

Requiring an "su" keeps somebody from brute-forcing the root password remotely. You're right that if they eavesdrop the connection that they get it either way. But with root-enabled telnet it's possible for an attacker to keep trying root passwords forever across the network and eventually they'll get in.

So disabling root access from telnet (or ssh for that matter) adds at least one more step somebody has to go through to own the system.

Re: Login as root

bong_3 — Sat, 21 Feb 2004 08:57:55 GMT

hi there,

i suggest you use ssh...
ssh [ip add] you can remote log in as root directly and offers security as well.

rgds,
Bong

Re: Login as root

Paul Cross_1 — Mon, 23 Feb 2004 13:14:33 GMT

Mark Travis:
But is ssh really any different? I could sit and type root passwds for root-enabled ssh until my fingers are nubs.

Re: Login as root

Chris Vail — Mon, 23 Feb 2004 17:39:05 GMT

Many responders have missed the point of having an /etc/securetty file. Logging in as root using telnet, remsh or rsh does not leave an audit trail. However, if you log into a private user, and use the su command, this is logged in the syslog file. This is part and parcel of any reasonably secure system. In a shop where multiple people have the root account, merely looking at this log tells you who actually was on the system when it was screwed up.
As a rule, secure shell is a superior way to go, as it also writes logs, but if its configured properly will not challenge for a password, yet still be secure.

Chris

Re: Login as root

Martin P.J. Zinser — Mon, 23 Feb 2004 21:40:38 GMT

Hello,

also to note, there is a root on every unix system I ever worked on, so this is a known good account to attack. Throwing in a "normal" user account in between means one more thing to guess for an outside attacker (does not help against internals though).

Greetings, Martin