How to restrict a user from logging remotely as a root user

[seizen]

On HP-UX v11,
how can I restrict a user from
logging remotely(rlogin or telnet)
as a root user?
A user can use "su" to be
a root user after logging as a regular user remotely.)
(In other words, a root user can login to the system only from the console.)
Please let me know.

Thanks,
Seizen

[Bill McNAMARA_1 · Accepted solution]

# echo console > /etc/securetty
# chown root:sys /etc/securetty
# chmod 644 /etc/securetty

Later,
Bill

[Thierry Poels_1]

hi,
"passwd" is a very good tool for preventing users to log on as root ;)
To limit the terminals where root can log on directly, create /etc/securetty and list the terminals (console!) where root may logon. (stay logged on as root on a terminal when setting this up!)

regards,
Thierry.

[Animesh Chakraborty]

Hi,
another way :-
Edit .profile of root as like these
#root.allow
user=`logname`;
sulog="/var/adm/sulog"
TTY="`tty | cut -d/ -f3`"

if [ ${user} = "root" ]
then

if [ ${TTY} != "console" ]
then
echo ":root login allowed only through console..."
exit
fi
else
grep ${user} /etc/root.allow > /dev/null 2>&1

if [ ${?} -ne 0 ]
then
echo " : ${user} is NOT ALLOWED TO LOGIN AS root"
date=`date "+%m/%d %H:%M"`
echo "ERR ${date} - ${TTY} ${user}-root" >> ${sulog}
exit
fi
fi
*****
create a file /etc/root.allow and enter user name who will allowed to do su.

best of luck
Animesh

[seizen]

Thank you very much for the answer.

Thanks,
Seizen

[PUJOL Gregory]

the use of /etc/securetty file disable the remote connection by telnet or rlogin. but it's always possible to remotely connect with Xwindow... I try this on HP-UX v10.20 ...

How can i do to enable remote connection with Xwindow ?

[David Lodge]

I would normally use the /etc/securetty method, but this won't disable all ways to log in, you can still get in via X or via ssh (if installed)

ssh can be restricted from the configuration file.

X can be restricted by the following:
# cp -p /usr/dt/config/Xstartup /etc/dt/config/Xstartup
# print "[[ ${USER} = root ]] && exit 1" >>/etc/dt/config/Xstartup

dave