etc/securetty

[hmorrison]

I was wondering if the etc/securetty file contains anything else besides the list of valid ttys for root login. Also, does it mean that if this file does not exist , root can be accessed from anywhere, providing the password is known?

[Patrick Wallek]

No, the /etc/securetty file shoud NOT contain anything other than the list of tty's root can log in from.

Yes, if the file does not exist then root can log in from anywhere.

[Victor BERRIDGE]

Hi,

All correct, with the only difference that if present, that doesnt mean root cannot access other than...
Understand it is not valid for X windows... (CDE environment)


All the best
Victor

[Patrick Wallek]

Oops -- too quick on the submit.

That is why it is recommended that the /etc/securetty file contain a single word: console

That way root can only log in directly from /dev/console, the direct attached console or a web console.

Another thing to think about though is SSH access. Unless your ssh.conf and/or sshd.conf (I can't quite remember) is configured correctly, then root can SSH from one machine to another. Have a look at the ssh.conf and sshd.conf man pages for information on how to restrict that.

[Jaime Bolanos Rojas.]

Hmorrison,

From the login man page:

"If the /etc/securetty file is present, login security is in effect, i.e., root is allowed to log in successfully only on the ttys listed in this file. Restricted ttys are listed by device name, one per line. Valid tty names are dependent on the installation. An example is

console
tty01
ttya1
etc.

Note that this feature does not inhibit a normal user from using the su command"

Regards,

Jaime

[IT_2007]

check sshd_config for the following line

#PermitRootLogin no

If it says uncommented and "yes" then root can login through ssh.

[Jaime Bolanos Rojas.]

Hmorrison,

Also please do not forget to assign points to people that is taking their time to help you out.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1058052

7 points to 61 responses.

Regards,

Jaime.