Disable root telnet access

[Andy Wu_2]

How do I disable root telnet access in HPUX 11i?

Is there a similar file like securettys for True64 to disable root telnet access?

Thanks
Andy

[David Child_1]

Andy, yes there is:

just enter 'console' in /etc/securetty and root will not be able to telnet to the server.

David

[Patrick Wallek]

Yes, there is. Create a file called /etc/securetty and put the word console in it.

# cat /etc/securetty
console

That will prevent root logging in directly from anywhere but the console. It will allow you to log in via telnet as a regular user and, if you know the root password, do a 'su -' to get to root.

[John Poff]

Hi Andy,

You can create a file named /etc/securetty in HP-UX and put the valid ttys where root can login from. Normally you will just put in 'console' and then root can only login at the console.

See the man page for 'login' for more information about securetty.

JP

[S.K. Chan]

Simply create a file called /etc/securetty (perm=440) and put the line
console
in it. That would ONLY allow root login from the console.

[Andy Wu_2]

David,

Duh... Thinking that if the file wasn't there, it couldn't be done that way.

Thanks for the quick reply!!

Andy

[Bill Hassell]

One additional 'feature' for securetty: if the file is empty, then no one can login as root through any channel (LAN, serial, modem, etc). Pretty secure, eh? Actually, this is a useful setting...any user can use su to become root, thus requiring two successful logins to become root, and with sulog, a good audit trail of who, when and where su was run.