Disabling ROOT access

[Joshua Leckner_1]

I am trying to disable ROOT access via remotely.


Anyone know how??

[pap · Accepted solution]

Hi,
Just put following entry in /etc/securetty

console

You can not login as root in this machine directly by doing this. You can be super user only after doing "su".


Thanks,

-pap

[Sandip Ghosh]

In the /etc/securetty file make an entry

root.

It should solve your problem.

Sandip

[Joshua Leckner_1]

what is the difference between adding "root" or "console" ??

[pap]

You have to put console only.

By putting entries of ttys like console tty01 tyy02 etc....
you can enabling access to root in those ttys.....for direct root access.

I never used "root" to mention in /etc/securetty.

-pap

[Helen French]

Hi Joshua:

It's console and not root ! The tty's listed in /etc/securetty will give secure login for root.

For confirmation:

# man login

HTH,
Shiju

[Joshua Leckner_1]

This still allows users to rlogin into this system with root.


Is there a way to also disable that without disabling root??


the host.equiv only has a "+" within it.

[Helen French]

Hi Joshua:

For rlogin you need to check two files - /etc/hosts.equiv and $HOME/.rhosts. If you find any entries there, then remove it or comment it. That may solve the issue.

# man rlogin for more details

HTH,
Shiju

[Sandip Ghosh]

If you put "root" in the /etc/securetty file then nobody could enter as root directly, not even from console. everytime he has to go as su -.

Instead if you put "console" then anybody can login as root from the console.

Sandip

[Darrell Allen]

Hi Joshua,

To disable rlogin to root, remove root's .rhosts file.

/etc/securetty is not checked if .rhosts allows the user to rlogin as root without a password. It is checked if a password is needed by rlogin.

BTW, /etc/hosts.equiv does not apply for root.

Darrell

[MANOJ SRIVASTAVA]

Hi Joshua

Do the following in /etc/profile

loginid=`who am i | awk '{print $1}'`

echo $loginid
if [ $loginid = root ]
then
exit
fi


This will just allow you to login as another user and then do a su.


Manoj Srivastava

[Deshpande Prashant]

Hi
I have following lines in .profile off root to block any direct logins/rlogins to root.

------
## To set direct root login to console only ##
#
user=`logname`;
sulog="/var/adm/sulog"
TTY="`tty | cut -d/ -f3`"
date=`date "+%m/%d %H:%M"`

if [ ${user} = "root" ]
then
if [ ${TTY} != "console" ]
then
echo " : root login allowed only through console..."
echo "ERR ${date} - ${TTY} ${user}-root" >> ${sulog}
exit
fi
fi

---------

Thanks.
Prashant Deshpande.