Restricting Users who can Login

[Alan Shearer_1]

Hi,

If I've disabled Telnet and all the r-services and use the AllowGroups option in sshd_config to restrict the users who can login to only those that are a member of my new group.

Are there any other means that a user could login who is not in my ssh allowed login group?

Thanks.

[Court Campbell]

From the console. ;)

[Paul Sperry]

you can restrict the console to root by putting this in the .profile.

TTYCHECK=`/usr/bin/tty | cut -d \/ -f4`
if [[ "$TTYCHECK" != "console" && $(whoami) = "root" ]]
then
echo $TTYCHECK
fi

[Bob E Campbell]

Personal preference, but as someone that often uses a non-root "root" I would change

$(whoami) = "root"
to
$(id -u) = "0"

or similar in the above. I would also consider having a script run that would monitor the file /var/adm/syslog/syslog.log and report any "unexpected" login attempts.

[Alan Shearer_1]

Thanks for the responses.

Not really what I was looking for though.

I am not talking about restriction of root login per se. I am talking about the control of who can login to the system by any means (excluding the console).

So with telnet and r-services disabled, I am focusing on controling ssh login access through the use of the AllowGroups option. Thus for ssh login a user will have to be in this group.

My concern is that there is a whole other angle I am not considering (other than the above) and am not controlling allowing anyone to login to the system. Can anyone think of any?

Thanks.

[Kenan Erdey]

Hi,

if allowgroups exits in your sshd_config file, only users of groups( it can be user's primary or secondary group ) that listed in config file can login. users in other groups can't.

[Robert-Jan Goossens]

Hi,

Disable ftp as you can use sftp.

Edit /etc/inetd.conf and comment out the ftp line, then run "inetd -c".

Regards,
Robert-Jan

[Alan Shearer_1]

Thanks again for the reponses.

I'm planning on using AllowGroups to restrict who can login based on them being a member of a group specified in sshd_config - so I know this will work for ssh.

I am worried about users being able to login via a different means (if there is one other than ssh, telnet, rlogin etc.) that I'm not addressing.

FTP is already disabled, as is TFTP. Remote x logins are disabled by an empty Xaccess file - should/can I do anything more to dtlogin?

Anyone spot anything I'm missing?

Thanks.