/etc/securetty file to limit access of root only to the console

[EJ Stremler]

Is /etc/securetty the correct path for this file? with permissions owned by root and 600?. We need to limit root access via ssh from other systems. We only want root to access via console only.

[Rick Garland]

The /etc/securetty file will allow direct root logins on the console if the 'console' is specified in the securetty file. Users will still be able to su to the root account.

To prevent root from logging in via ssh, modify the sshd.config file and look for the 'PermitRootLogin line. Change this to 'no'.

The location of the file is in /opt/ssh/etc if you installed the HP version of Secure Shell. If you have the SSL download version it could be elsewhere.

The newest version of HP's Secure Shell will honor the securetty file contents.

[D Block 2]

Ed,
try a: $ man login

put the "console" as the first entry in the securetty file. Test using another window and stay connected as root on your first window. Also, verify that you can get on the CONSOLE device via telnet to the GSP's IP address before writing this file out.

If using SSH, you might want to verify a test and you might have to update the SSH login definitions to only-ALLOW a set of login-names and Dis-ALLOW all others.

[EJ Stremler]

I had updated the /opt/ssh/etc/sshd_config file to "PermitRootLogin no", and root is still able to get in via ssh, do i need to stop and start the sshd?

[Rick Garland]

Yes - stop and restart the sshd process.

[Paul Sperry]

Ed,

Don't forget not to use # or @ in roots password. Otherwise root will not be able to log in at the console

[EJ Stremler]

Thank you all for your fine answers...