/etc/securtty message "Invalid Login"

[Timothy Ng]

I have put in "console" into /etc/securtty to allow root login from console only. However, when operator try to remote login root, message "Invalid Login" is prompted which makes people think a wrong password is entered. The retrying may lock up the root account in a Trusted system. Anyway to configure HP to provide more meaningful message like "Console Login Only"?

Version 10.20

Thanks!

[Bill Hassell]

Thyere is no way to configure the error message. However, you may wish to leave root disabled...many sysadmins will do this by creating a securetty file with nothing in it. Now, root logins are only possible with su as in:

/usr/bin/su - root

(always use the - root option). In this way, 2 logins and passwords are required to gain root access.

[Tim D Fulford]

I agree with Bill about your problem.

However, I would keep /etc/securetty with console entry in it. This is because if you have networking issues you can log on as root at the console. This is especially important if the machine uses central authentication as in effect without the console entry the machine is unusable even if it is possible to fix it from the console!

Tim

[Philip P. Hartl · Accepted solution]

In a secure environment, which is what you are attempting by creating the securetty file, the idea is to provide as little information as possible, therefore the message "Invalid Login" is the proper response. Your concern about disabling root by repeated attempts in a trusted system environment is unfounded, however, since should root be disabled due to excessive attempts, it will still succeed at the console. A message warning that root has been disabled will be displayed, but console logon is permitted and when successful will reset the invalid logon counter. This can effectively warn you if someone attempts root access illegally.

[Timothy Ng]

Just want to thanks for all the helpful advice. It is always a tradeoff between security measures and operational efficiency. A balance has to be found and exploring the alternatives do help me to find a good point.