Restrict root from Doing telnet .

[Mr.Right]

I am new to HP-UX Admin , and need help form all HP-UX Gurus out there.

1. I want to restrict root form doing telnet to my HP-UX Servers.?

Please help me it's urgent.

[Tim Nelson · Accepted solution]

create /etc/securetty with the text of "console" ( no " required )

This will restrict telnet for root to the console.

If ssh is used then this will have no effect.
If exec is used this will have no effect
If remsh is used then this will have no effect
If SMH is used then this will have no effect.

Lots more security issues to cover.

Your only other option is to write something into /etc/profile or /.profile to check the tty and exit if not /dev/console. But.. if you allow ftp for root someone can just replace that file with something else. So you should also lock out root ftp, and sftp, and rcp ... and so on.

Beware you may just lock yourself out if you get things too tight.

[Tim Nelson]

BTW,

Is your first name Always ?

lol

[Bill Hassell]

The simplest method is to change root's password on each system. WShat problem are you trying to solve? Are these systems using a centralized password server such as NIS? As mentioned, there are many ways to login to a system so more details are needed.