remote root login

[himacs]

Hi,

Can anbody tell me how to check remote root login enabled or not?

In solaris we have /etc/default/login file.
We have to uncomment the /dev/console field.

Is ther any way to check the same in hp-ux?

Regards,

[Steven E. Protter]

Shalom,

This is somewhat dependent on connection protocol.

ssh:

http://docs.hp.com/en/5992-3387/ch05s06.html

DCE

http://docs.hp.com/en/5991-7712/ch02s04.html

telnet et al
http://docs.hp.com/en/5992-3387/ch05s01.html

SEP

[Tingli]

For telnet the file is /etc/securetty. For ssh it is /opt/ssh/etc/sshd_conf.

[himacs]

Hi guys

I dont want to any user to use root account on the network.Only thro direct console only root should work.

regards,

[Tingli · Accepted solution]

That is right. To block root login from non-console you need to:
1) echo console >> /etc/securetty
2) In file /etc/ssh/sshd_conf, you need to set "PermitRootLogin no"

[Tingli]

Sorry, the file sshd_conf is located in /opt/ssh/etc.

[himacs]

Hi Tinqli,

Thnks for the response.

Can u please brief me about the
echo console>>/etc/security.

Regards,

[Tingli]

Or you can edit the file /etc/securetty. And add a line "console" to the end of the file.

[himacs]

Hi Tinqli,

I didnot find any file named /etc/security and /etc/securetty.Is this default one or we need to create manually?

Regards,

[Tingli]

Here is a link about it:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1233691010179+28353475&threadId=1174327

[himacs]

Hi Tinqli,

Thanks for ur timely response.

As m new in hp-ux, i have some doubts.

/etc/securetty file is default one or manually we need to create?

becuase i didnot find the same in my system.

regards,

[Patrick Wallek]

You must create it.

The easiest way:

# echo console > /etc/securetty

[Sani]

Hi Himacs ,

Through /etc/securetty and /opt/ssh/etc/sshd_conf , you can rstrict direct root login to the server.But at the same time any user can login with his username and switch to root (su -)....

To prevent this you have to add an entry in /etc/default/security file . ie

SU_ROOT_GROUP=group

Now users attempting to su to root must be a memeber of this group .

Thanks