topic Re: direct root access restrict..... in Operating System - Linux

direct root access restrict.....

sukumar maddela — Sat, 29 Oct 2005 04:44:49 GMT

Hai all,

In my company every one are login directly as root. i would like to restrict that direct login to root. I would like all users to login using an individual user account and then use SU as necessary.

plz prepose some solutions to this problem.

thanks and regards
sukumar

Re: direct root access restrict.....

Kodjo Agbenu — Sat, 29 Oct 2005 13:02:05 GMT

Hi,

If you are talking about a single or a few number of servers accessed by many people :

1 - Make sure that you have a file named /etc/securetty, with the following content :

tty1
tty2
tty3
tty4
tty5
tty6
vc/1
vc/2
vc/3
vc/4
vc/5
vc/6

It means that root can logon only on local console (not remotely).

2 - In SSH configuration file /etc/ssh/sshd_config :

PermitRootLogin no

Then restart sshd to apply changes.

If you are talking about Linux desktops or workstations, there is no solution : if the user have some Linux knowledge, (s)he can by-pass any protection you may setup. Therefore, the only method in this case is education, security awareness, ...

Good lcuk,
Kodjo

Re: direct root access restrict.....

Steven E. Protter — Sat, 29 Oct 2005 15:06:05 GMT

Create users for the other people and change the root password.

Make sure you have backing from management but I think they'll agree root access for all is like playing with matches in an ammunition dump.

SEP

Re: direct root access restrict.....

Sorrel G. Jakins — Sat, 29 Oct 2005 22:38:00 GMT

Get a utility called "sudo" - then any user who needs to issue a specific root-level cmd can be set up in a permissions table and can only do what you permit him to do. sudo activity is logged.

HTH
Sorrel

Re: direct root access restrict.....

Alexander Chuzhoy — Sun, 30 Oct 2005 03:57:09 GMT

The fastest solution is to change root's password,thus preventing from users to login as root.
If you want to have centralized management of users then you should consider to setup domain (NIS or LDAP ).

Re: direct root access restrict.....

Andrew Cowan — Sun, 30 Oct 2005 09:49:13 GMT

Make use of TCP-Wrappers for all services by editing "/etc/hosts.allow" and "/etc/hosts.deny". This enables to tie-down users to specific IP-Addresses or subnets. That way if users try from another location they will be denied access.

Re: direct root access restrict.....

Andrew Cowan — Sun, 30 Oct 2005 09:54:01 GMT

Another couple of nice security tweaks:

1. Use PAM to disable the system-wide usage of .rhosts files in user's home directories by adding these lines to /etc/pam.d/rlogin:

#
# Disable rsh/rlogin/rexec for users
#
login auth required pam_rhosts_auth.so no_rhosts

2. Limit who has access to the command.
One of the simplest ways to do this is to add users to the special administrative group called wheel. To do this, type the following command as root:

usermod -G wheel

In the previous command, replace with the username being added to the wheel group
Next, open the PAM configuration file for su â /etc/pam.d/suâ in a text editor and remove the comment [#] from the following line:

auth required /lib/security/pam_wheel.so use_uid

Doing this permits only members of the administrative group wheel to use the program.

Re: direct root access restrict.....

Rick Garland — Mon, 31 Oct 2005 12:39:30 GMT

I am a fan of the 'wheel' group solution.

If all of the users know the root passwd, they cannot login as root, they cannot su - to the root either.

Use the /etc/securetty file to allow direct root login only on console.

If using ssh, modify the sshd_config to PermitRootLogin No

For telnet, the /etc/securetty file will suffice.

For ftp, use the ftpusers/ftpaccess files.