dual password authentication

[Syed Nazer Abbas]

Is there any way to implement dual password authentication on root user. like first SA enter password and then Senior SA enter password then we get the root login?. I found this on AIX but dunno if there is such method in HP-UX

[Bill Hassell]

The simplest method is to not allow root logins from any location except the console. Do this by setting up /etc/securetty:

echo "console" > /etc/securetty

Now, to attain root login, you must first login as a normal user, then use su - root to login as root. Then restrict the users that are allowed to use su for root login by creating a special group in the /etc/gtorup file, making those selected users members of that group and setting the parameter: SU_ROOT_GROUP equal to that group name. The SU_ROOT_GROUP parameter is added to the file: /etc/default/security. See the man page for security.

[Syed Nazer Abbas]

yes that can be implemented in such a way. But thats a work around of the problem. not exactly the solution of the problem

[Manix · Accepted solution]

Hello Sayed !!

I have seen this at certain client ends where they login on to the server through ssh
i.e user accounts & then use a third party
authentication software like power broker for root access & secure authentication.

I hope sudo is not very safe and recommended
by HP.


not very sure if you are looking at some thing else. i don`t think native OS has this kind of mechanism.

Thanks

Manix

[sarfaraj ahmad]

Hi sayed,

there is no feature included in Native HP UX OS for dual authentication of administrator account.

better to go with solution as described by bill and not suggested to use any third party.

[Syed Nazer Abbas]

I found RBAC role based authentication on HP-UX. I think that may provide me the features by sudo. Hope one day hp could work on this to provide dual authentication on the ciritical accounts.

However, appreciate all your replies and expert advices and help.

[Syed Nazer Abbas]

closing the thread now