Disable root rlogin

[Henry Nguyen]

Hello All:

Is there a way to disable rlogin for root, but allow all the r* services enable(ie. rcp, remsh...) for root. I have already set up an /etc/securetty file to force root login only from the console. I would configure the /var/adm/inetd.sec file, but this would disable rlogin for everyone. I'm only interested in disable rlogin for root. Any advice is appreciated.

Thanks,
Henry

[RAC_1 · Accepted solution]

TCP wrappers.

Check /etc/hosts.allow and /etc/hosts.deny

Anil

[Hai Nguyen_1]

That's not true. With /var/adm/inetd.sec, you can specify a user ID which you want to deny a service. Man inetd.sec for an example.

Hai

[RAC_1]

Henry,

There is no way, you can do that with inetd.sec. If is for rejecting/allow service to a host/network

Your only option seems to be tcp wrappers.

Anil

[Jeff Schussele]

Hi Hai,

I have to agree w/RAC on this one.
With inetd.sec granularity can only go down to hostname/IP as well as subnet.
With tcp-wrappers you *can* go down to username - like:
username@hostname.com

Henry - I believe that's the only way you can do this short of some code in /etc/profile that will query access method as well as login name to disallow root rlogins.

tcp-wrappers cab be had here:

http://hpux.cs.utah.edu/hppd/hpux/Networking/Admin/tcp_wrappers-7.6/

highly recommended.

Rgds,
Jeff

[Hai Nguyen_1]

Jeff and RAC,

You are both right. My bad for believing my memory with reviewing the man page. Henry, inetd.sec cannot handle this. Sorry for my mistake.

Hai

[Simon Wickham_6]

Hi,

Have you checked /etc/inetd.conf and run inetd -c to pick up the changes if required. Also ensure no TCP wrappers by checking if you have a /etc/hosts.allow and /etc/hosts.deny.

It also worth checking /var/adm/inetd.sec for any entries.

Regards,
Simon

[Muthukumar_5]

Yes. You can simply make in /.profile file.

/.profile

ps | grep -q 'rlogind'
if [[ $? -eq 0 ]]
then
echo "ERROR: rlogin with root account is disabled"
sleep 2
exit 1
fi

Note: remsh is like rlogin

It is working.

--
Muthu