Directly login deny

[Manuel_8]

Hello guys,
I want thet the root user can't log directly on the system, but only whit su - root command.

Please help me

Thanks

[Sridhar Bhaskarla]

Hi,

Create /etc/securetty file with "console" in
it. It will allow root to login from console only. Others have to login as themselves and then su to root.

#cat /etc/securetty
console

-Sri

[Jeff Schussele]

Hi Manuel,

Create the following file
/etc/securetty
containing only the word
console

This prevents root from logging in from anywhere except the console.

HTH,
Jeff

[Dietmar Konermann]

Hi!

Just create a file /etc/securetty containing the line "console". See login(1) man page.

Please note that not all services respect this feature! E.g. ftp needs to be denied for root also. Same for rexec. Otherwise one could e.g. use ftp as root to remove the /etc/securetty file.

Regards...
Dietmar

[James R. Ferguson]

Hi Manuel:

Create a file titled '/etc/securetty'. When present, root is allowed to log in only on the devices listed in the file. Enties are the device tty name, one per line.

In your case, specify "console" so that root can login at the console device, but no where else unless an 'su' operation is performed to root.

Regards!

...JRF...

[S.K. Chan]

YOu can do this by creating the file /etc/securetty with the word
console
in it. The file should have permission 600 (root:bin). That will disable direct root login from any tty port EXCEPT at the console.

[Sajid_1]

This can't be done totally. But you can restrict the root direct login to specific ttys (for eg: console). For doing this, edit the /etc/securetty file and add the 'tty' entries there and the root login can only be done from there. But you can do a 'su' from all terminal sessions.

[Chris Wilshaw]

If you wish to prevent root from logging in on the console too, rather than having console in /etc/securetty, you can just create a blank file. Then root is only usable via su.

> /etc/securetty

ll /etc/securetty
-r--r--r-- 1 root sys 0 Aug 13 15:31 /etc/securetty

[MANOJ SRIVASTAVA]

Manuel


What we do is to add the following lines in the /etc/profile


loginid=`who am i | awk '{print $1}'`


echo $loginid
if [ $loginid = root ]
then
exit
fi

this will make you just su to root


Manoj Srivastava