Preventing Telnet by Root but allowing only certain logins

[Laurie A. Krumrey]

Hi All,

I hope all those in NYC are OK. I'm from
NYC so I am very glad all my family and friends
are OK. Working seems to help deal with the
pain.

I have a L2000 on 11.0 and I want to not
allow ROOT to telnet in (we have a web
console for that) and only allow 3 users
to be able to telnet in.

I have SUDO installed so once these 3 users
log in, they can use SUDO and do whatever
they want.

This is for high security on our most important
box. We have a TRUSTED system and we are
not using NIS, and we don't want to use
NIS (trust me on this).

I think I need to do something to the
/etc/services and the /etc/passwd file???

Thanks for your help,
Laurie

[Santosh Nair_1 · Accepted solution]

Edit the file /etc/securetty and list only console...this prevents root from directly loging into the system other than at the console.

-Santosh

[G.Kumar]

hi

This link may help you.
http://forums.itrc.hp.com/cm/QuestionAnswer/1,1150,0x41b76af52b04d5118fef0090279cd0f9,00.html


GK

[linuxfan]

Hi Laurie,

To prevent direct root logins do this
echo "console" > /etc/securetty
chmod 400 /etc/securetty

(This would limit direct root logins to the console)

Since you said your system is TRUSTED, you cannot run NIS. NIS+ is an option but i don't know if you want the additional work.

The other option is modify your /etc/profile to allow only certain users to login.

Since you say it is an important machine, any reason why you are allowing telnetd to run rather than sshd?

-Regards
Ramesh

[Joseph C. Denman]

The above are correct. Putting console in the /etc/security file will allow root to only sign-in at the console. As far as only allowing 3 of your users telnet, you could do a couple of things depending on your environment/network. If you are not separated from the 3 users by a firewall, you could set up /etc/inetd.sec file to only allow connections from those hosts. Users other than the 3 telnet users, you could give them a bogus shell such as /sbin/false in /etc/passwd. This would also disallow telnet. The bogus shell would contain "exit 1".

Hope this helps.


...jcd...

[Chris Calabrese]

If this is a high security system, then it is a big mistake to allow either Telnet or HP Web Console access _AT_ALL_.

Anyone capable of sniffing the root password through a root telnet is also capable of sniffing the passwords passed to sudo and to the web console.

What's that you say, web console traffic encrypted? Yes, but by crackerjack box ring decoder variety encryption. See Bugtraq postings from last year on how trivial it is to crack (much easier than the protections NIS has through Secure RPC).


I've taken HP to task on this on several occasions, but so far they haven't done anything about it (something about using too slow a processor to do real encryption - a pretty lame argument considering that this was only a few months after the thing came out and they could have long since fixed the problem by now - especially given how much they charge for these things).

If you want your system to be reasonably secure from sniffing attacks, use newer versions of OpenSSH for network access and OpenSSH connecting to an SSH-capable terminal server for console access (several vendors, including Cisco, sell such things, though it's also easy to turn an old 486 running Linux or *BSD into one). IPsec based protections would be even better (including telnet over IPsec).

Don't use regular Telnet, HP Web Console, FTP, or even older versions of SSH.

[Sanjay_6]

Hi,

Looks like putting "console" in your /etc/securetty file is your best bet. Though your users once logged in using telnet can still "su" and can gain root access.

Hope this helps.

thanks

[John Payne_2]

If you are happy and satisfied with your installation of sudo, there is no need to "ever" login as root. (Although someone needs to either know the password or be able to get it in an emergency...) You can set the /etc/securetty entry to something invalid like 'EatatJoes' and not worry about it. Then you force users to log into box and use sudo. Also, give yourself or whoever is the person who really needs root the ability to 'su -' Then you can be the only one who knows the password. (If that is what you want.) I prefer to call the SWC the 'protected web console.' It's better than plaintext, but I also call secure shell 'protected shell.' There are holes almost anywhere you look, and if someone really wants to get at your data, etc., it difficult to build a system that is impervious. (Short of pulling the connection from the NIC.)

[Chris Calabrese]

Agreed, nothing is ever 100% secure.

However, there are huge differences between encryption technologies...

IPsec is built on a very strong foundation with only the more theoretical of attacks discovered against it (and then only DoS attacks - not direct compromise - and with fixes under study).

Newer versions of SSH are built on a reasonably sound protocol foundation with some odd implementation problems found (and fixed, at least in OpenSSH) over the years.

Older versions of SSH (i.e., Protocol version 1.x) were built on a shakey foundation.

SWC is built on jello.

Telnet is built on wishful thinking.