Restricting direct root login on console

[Kavita Poonia]

Hello All,

I need to disable direct root login on console of HP-UX11.31. Can anyone tell me the process for that ?

Thanks & regards,
Kavita

[Matti_Kurkela]

The requirement to disable root login on console suggests that your server's physical environment is not secure. Fix that first.

You can then e.g. point at the big, secure lock in the door of the server cabinet and say "*That* is what prevents root logins on the console." Most auditors will understand that a locked door can be used to secure the system.

But if you really want to do it through software configuration, make sure you have some authorized way to access the root account, like sudo, PowerBroker or whatever. Then set a very long and difficult root password, don't document it anywhere and just forget it.

If you have the optional free "LongPassword" depot for 11.31 installed (it's available at software.hp.com), you can use passwords of up to 255 characters.

A 80-character root password that is completely random and not written anywhere will make direct root logins pretty much impossible.

But remember:
If an unauthorized person has a physical access to your server and really wants your data, he/she will just crash & reboot your server to single user mode to get it.

If the system is configured to require a password to access the single user mode, the unauthorized person will just plug in a disk with his/her own OS installation or boot the system using the recovery mode of a HP-UX installation CD.

Bottom line: *All* the protections of the OS can be worked around if the hardware is not physically secure.

MK

[Kavita Poonia]

I want to disable direct root login on console as I want another user logging in on console and then doing su to root.

[Raj D.]

Can you tell more about what you are refering actually as console?
Usually all devices tty/pty etc other than console is restricted for direct root login. As console is considered to be a safe place for root login.

Raj.

[Raj D. · Accepted solution]

Kavita,

Disable direct root login:

You have to add "PermitRootLogin no" to /opt/ssh/etc/sshd_config file: & stop/start ssh.


http://forums11.itrc.hp.com/service/forums/questionanswer.do?&threadId=742400

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=&threadId=1367457



Restricting direct root login on console:
This document talks about:


http://dataprotected.files.wordpress.com/2008/05/hp-ux-security-check.pdf

Disable direct root login:
Restrict root logins to system console:


Hth,
Raj.

[Raj D.]

Kavita,

>Restricting direct root login on console:
You can do something like this:

Add this line to global .profile , and try it out: (Before adding to actual scenario you may test the script first on a console session ):


At the end of .profile :
#---------------------------------

TTY=`tty`
ID=`whoami`

if [[ $TTY -eq "/dev/console" && $ID -eq "root" ]]
print "Root Login on Console!! is not allowed! Exiting!" > /dev/console
exit 0
else
print "User $ID logged in to console: `date`" > /dev/console
fi

#--------------------





Cheers,Have fun!,
Raj.

[Raj D.]

correction: (missed the "then" statement ) : fixed.


#---------------------------------

TTY=`tty`
ID=`whoami`

if [[ $TTY -eq "/dev/console" && $ID -eq "root" ]]
then
print "Root Login on Console!! is not allowed! Exiting!" > /dev/console
exit 0
else
print "User $ID logged in to console: `date`" > /dev/console
fi

#--------------------

cheers,

[Deeos]

Hi kavita,


you just simple create a file .

#touch /etc/securetty

that's it
now you can try to log in through MP Console
It will never allow you to log in!


Regards
Deeos

[Bill Hassell]

If the file /etc/securetty exists as an empty file, root logins will be rejected regardless of whether the correct password is used. However, ordinary users can login through the console.