Removing direct root access

[Adam Noble]

We are in the process of tightening up security on a number of HP systems. We intend to remove direct root access to the system and are looking at the best way of doing this. Obviously we will still need to log into the console as root, however the intention is for users to su to root once on the system.

[Francis_12 · Accepted solution]

Hello,

/etc/securetty

If the /etc/securetty file exits, root user is only allowed to login in the tty's listed in this file.

Normally, you allow root logins ONLY at
the console. On all other logins must be logged in using user's own id's. If they are needing root priviledge, they will have to su -.

Now, that user needs to do su's to become root, all su's are logged in
/var/adm/sulog.

To do this, create /etc/securetty with only the console entry.

Hope this helps,

Francis DERDEYN - HP-UX ASCE.

[Jeff Schussele]

Hi Adam,

You do this by creating the following file
/etc/securetty
and placing one word in it
console

Then set perms to 400 (-r--------) & ownership to root:sys

HTH,
Jeff

[Brian Bergstrand]

Add 'console' to /etc/securetty.

Then root will only be allowed to login directly via the console.

HTH.

[Stuart Abramson_2]

vi /etc/securetty
add:
console

This prevents rlogins of form:

rlogin host -l root

but still allows root logins from other hosts with entries in $ROOT_HOME/.rhosts

[Adam Noble]

thanks all!

[Francis_12]

Hello back again,

There is still something missing here :-)

/etc/securetty is not checked if your users are going to try to log in via CDE. The reason is that /etc/securetty "lists the valid ttys for root login". Since CDE does not use a tty to login the /etc/securetty
has no effect !!

To bypass that limitation, you will need to modify the /etc/dt/config/Xstartup to disable
root console login via CDE.

You might also be interested to use the file /usr/dt/config/Xaccess which restricts external CDE access based on host(IP).

Hope this helps, Bye.

Francis DERDEYN - HP-UX ASCE.

[Adam Noble]

Actually does anyone know of any further restrictions you can make i.e on AIX you can restict a certain group of users to be able to login as root and also I believe you can prevent people logging into ftp as root.

[Francis_12]

Hi back again,

To secure FTP, go here :

http://www.newfdawg.com/SHP-FTP-ftpaccess.htm
and here :
http://www.newfdawg.com/SHP-FTP-ftphosts.htm

Hope this helps, Bye.

Francis DERDEYN - HP-UX ASCE.