How can I restrict user root can only login system using console?

[稀里哗啦]

I don't want anyone login system with root privilege except who use console.

[Stefan Farrelly · Accepted solution]

echo "console" > /etc/securetty

This will only allow root to login on console or someone to log in first as a normal non-root user, then su - root.

[Michael Tully]

Hi,

Create a file called /etc/securetty

Add the entry 'console' without the quotes. Save the file. Make sure that the file has these permissions:

# ll /etc/securetty
-r-------- 1 root sys 8 May 3 2001 /etc/securetty

# more /etc/securetty
console

HTH
~Michael~

[稀里哗啦]

Thanks.
BTW, Can you tell me how can I get relate docs for /etc/securetty file?

[Frederic Sevestre]

Hi,

In a addition of the securetty file, if you are using dtlogin you will have to deny root in /usr/dt/config/Xstartup and /etc/dt/config/Xstartup :

...
if [ "$LOGNAME" = "root" ]
then exit 1
fi
...


Regards,
Fr??d??ric

[Nick Wickens]

Details of securetty can be found in the man page for login. ie -> man login

[Bill Hassell]

As mentioned, securetty is documented in the login man page. However, the man page is not too clear about the tty names. What is missing is the caution: do not use full pathnames, as in: /dev/console.

The reason is that login prefaces each line in /etc/securetty with /dev/ which means a full pathname would look like: /dev//dev/console and this would fail since the name of the console is /dev/console.

What if there are no valid tty names in the file, or perhaps there is nothing in the file? Again, the man page is not clear, but the behavior is: no root logins from *any* device on the system. That includes the console (pretty darn secure, eh?)

Actually, there is a real good reason for this. With a null /etc/securetty file, all root access requires 2 logins and 2 passwords, one set for a normal user and a second set for su. NOTE: always use su -, never su by itself and this goes for all users (ie, su - lp).

Finally, for 11.0 and 11.11, there is an additional level of security rules available which are controlled by (oddly enough) the /etc/default/security file. Read the details in the man page called security (11i) or see the man page at http://docs.hp.com, search for: /etc/default/security.

[Deshpande Prashant]

Hi
The X logins will not get restricted by /etc/securetty file.
I use following in .profile of root to restrict direct root login on console.
##---
user=`logname`;
sulog="/var/adm/sulog"
TTY="`tty | cut -d/ -f3`"
date=`date "+%m/%d %H:%M"`

if [ ${user} = "root" ]
then
if [ ${TTY} != "console" ]
then
echo " : root login allowed only through console..."
echo "ERR ${date} - ${TTY} ${user}-root" >> ${sulog}
exit
fi
##-----

Thanks.
Prashant.

[Keith Buck]

HP-UX Bastille can do this for you, along with a lot of other security best practices. A beta version is available at

http://www.bastille-linux.org
(click on "Download BETA w/ HP Support")

If you choose to do so, it will put "console" into securetty, just as suggested by others.

Note also that X logins may allow root to login directly, and Bastille can help you configure this as well.