restrict console login

[gany59]

how to restrict the root user to login to the console directly. I need to set the limitation like if the user needs to login as root, they must be use the su - root command to switvh as root.

How can we set that one

[Steven E. Protter]

Shalom,

Read:
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1367457

SEP

[Kapil Jha]

u have to see securetty file

http://www.faqs.org/docs/securing/chap5sec41.html

BR,
Kapil+

[Suraj K Sankari]

Hi,

The /etc/securetty file allows you to specify which TTY devices the root user is allowed to login on. The /etc/securetty file is read by the login program usually /bin/login. Its format is a list of the tty devices names allowed, and for all others that are commented out or do not appear in this file, root login is disallowed. Disable any tty that you do not need by commenting them out # at the beginning of the line. Edit the securetty file vi, /etc/securetty and comment out the following lines:
tty1
#tty2
#tty3
#tty4
#tty5
#tty6
#tty7
#tty8
Which means only root is allowed to login on tty1. This is my recommendation, allowing root to log in only on one tty device and use the su command to switch to root if you need more. devices to log in as root.

For ssh we need to do like this

echo "PermitRootLogin no ">> /opt/ssh/etc/sshd_config

restart sshd demon

/sbin/init.d/secsh stop
/sbin/init.d/secsh start

Suraj

[Horia Chirculescu]

In addition to Suraj's post, you should disable telnet (as a general rule) and permit only SSH.

Best regards,
Horia.