Blocking Root telnet

[Raghuram Ollakal_1]

I would like to know in HPUX is there a way I can block telneting to server as " root" other than a user. I know in Sun Solaris I can block telneting as root.

[Patrick Wallek]

To keep someone from logging into the box directly as root from anywhere EXCEPT the console create the file /etc/securetty
and put the word

console

into the file.

# cat /etc/securetty
console
#

This will allow root to login directly from the console only. If a user has the root password, however, the user can login as him or her self and then do an 'su -' put in the root password and be logged in.

[David Lodge]

Note the above will *only* stop telnet and IIRC rlogin. If you require to stop root logging in via other mechanism (eg ftp, ssh, xdm) then you have to configure those bits seperately.

FTP is easy - just put the word root in the /etc/ftpd/ftpusers file.

To stop root in xdm you have put a little scriptlet in the xstartup file...

[Bill Hassell]

One additiobnal note: You can eliminate root from logging in from ANY source with:

cat /dev/null > /etc/securetty

Now this might seem to be a bit extreme, it is actually a useful mode. It means that anyone that needs root capability must supply 4 pieces of information: two logins and two passwords. In other words, only su will work to attain root user login.

NOTE: Never use su by itself...always, always use su - (that's a trailing minus character) to ensure that root will run /etc/profile and .profile rather than inheriting an unsecure environment.

[Uday_S_Ankolekar]

hi,

Insert word 'console' in /etc/securetty file
By doing this you can login as your username only.. If you want root previlage you can do su once you login.

Goodluck

-USA..