How to restrict access to root to the users

[Carme Torca]

Hi,

I would like to accept or to deny users' access to root.
Is it possible?.
And another thing, how could I deny acces to root first, I want to the users connect first to one user and then do # su - root

Thanks,
Carmen.

[Robert-Jan Goossens]

Hi Carmen,

Setup the /etc/securetty file.

# echo console > /etc/securetty

Root can only direct login on the console.

Regards,
Robert-Jan

[Steven E. Protter]

Shalom,

/etc/securetty

Have that file say console

An entry in there will restrict login to console only. That might make administration a bit more difficult. That does not deal with su - root logins. That can be disabled with pam configuration.

SEP

[Ivan Krastev · Accepted solution]

Set SU_ROOT_GROUP in /etc/default/security.

SU_ROOT_GROUP=group_name The root group name is set to the specified symbolic group name. The su command enforces the restriction that a non-superuser must be a member of the specified root group to be allowed to su to root. This does not alter password checking.


See doc for more details - http://docs.hp.com/en/B2355-60103/security.4.html

regards,
ivan

[Patrick Wallek]

>>I would like to accept or to deny users'
>>access to root.
>>Is it possible?.

Yes it is possible. Don't give your users the root password. The root password should be known to a VERY LIMITED number of people.

Other than than, the /etc/securetty and SU_ROOT_GROUP suggestions above are spot on.

[A. Clay Stephenson]

If you have to ask the first question then I seriously doubt that YOU should have root access. Having a system where many people have root access is a sure method for system destruction. The root password should be severely restricted and only a few well-qualified people (meaning they know what they are doing) should have access. If that condition is met, it largely eliminates the need for your second question although that is easily done by created an /etc/securetty file with only the entry "console".