/etc/securetty file

[Jerry L. Sims]

Hello Gang,

I attempted to prevent people from accessing
the system w/ ('root' ID) remotely. I thought I could control this with the `securetty` file ? but it does not work. I also viewed the
'/var/adm/inetd.sec`, but found no help there.
Please advised. Thanks.

# ll /etc/securetty
-rw-r--r-- 1 root sys 8 Jan 29 15:12 /etc/securetty

cat /etc/securetty
console

[Rodney Hills · Accepted solution]

Your setup looks correct.

Are the remote people using rlogin or ssh?

Only those users that actually run "login" will be prevented (ie telnet).

HTH

-- Rod Hills

[Jerry L. Sims]

Yes, they are using "ssh".

[Sridhar Bhaskarla]

Hi,

I believe you checked for any ghost characters in /etc/securetty file. It should work.

Are you saying "root" is able to login directly with telnet|rlogin even with this file?

-Sri

[Rodney Hills]

If you don't want people using "ssh" as root from another system,then you can remove the access for "root" on that machine.

Folder .ssh on home directory of "root" has the files that allows people to ssh in.

-- Rod Hills

[Jerry L. Sims]

Hello Sri,

The /etc/inetd.conf has:
telnet
rlogin
login
rexec
and so on commented out.

Only "ssh & ftp" are allowed.

[James A. Donovan]

SSH doesn't look at the /etc/securetty file.

You need to modify your sshd_config file so that the line with PermitRootLogin is uncommented and is set to "no".

Then restart your sshd daemon.

[Seth Parker]

Are you using the /etc/ftpd/ftpusers file? If not, you can restrict root from using FTP by adding root to ftpusers. The file does the opposite of what it seems like it would do: any user listed in the file is denied access.

All you'd have to do is "echo root>/etc/ftpd/ftpusers" and root should be denied access immediately. The ownership of the file should be "bin:bin" and the permissions 664.

Check out the man page for ftpusers for a little more info.

Regards,
Seth

[Igor Sovin]

Hi!
file /etc/securetty must contain:

console
/dev/console

then remote access as root would be disabled

[Mobeen_1]

Jerry,
If you have SSH implemented on your systems then you need to set permitrootlogin to NO in the ssh config file.

If you don't have SSH implemented then look at making changes to inetd.conf file

rgds
Mobeen

[Jerry L. Sims]

Thanks Jim D.

The "PermitRoot" modification in "sshd_config" works. Thanks....... :>)