How to limit root login from eXceed?

[Chia-Lin Mei]

For security consideration, we have to limit root login. We have used /etc/securetty to limit root login from telnet. However, we always can't limit root login from eXceed. We try the following workaround but still failed. Please advise.

# vi /etc/dt/config/Xsession.d/0001.nologin

case "$USER" in

root)
/usr/dt/bin/dterror.ds \
'Deny root login !!\n' \
'nologin' \
'OK'
exit 1
;;

*)
: # do nothing
;;
esac

[Arunvijai_4]

A similar thread can help you,
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=840663

-Arun

[Muthukumar_5]

You have to use /usr/dt/config/Xstartup file to put this script as,

if [ ${LOGNAME} = "root" ]
then
/usr/dt/bin/dterror.ds \
'Deny root login !!\n' \
'nologin' \
'OK'
exit 1
;;
fi

Or else put this in root's home directory $HOME/.dtprofile file.

Note: Don't use USER environment variable when you don't have SSH connection. It is ssh variable. Use LOGNAME instead.

hth.

[Robert Fritz · Accepted solution]

Hi there,

The easiest way to disable logins (though not root specifically) via XDMCP is via Bastille.

Run "bastille" on an 11.23 system (or download the app for 11.0 or 11.11), and answer the associated question "Y". While you're in there you'll also see other useful security-lockdown features you may want to use.

Bastille is an easy-to-use, supported, graphical wizard that walks you through security hardening.

Also, note that Bastille can also perform the securetty edit you guys currently do "manually" or via a home-grown script.

Hope that helps,
Robert