rlogin

[Junior C.]

How do I prevent user from rlogining as root.

Thanks,

Junior

[Andreas Voss]

Hi,

don't know if your users know the root password but when not rlogin as root without password is controlled via /.rhosts
If you remove the /.rhosts rlogin as root requieres passord.

[Benoit MARC]

Hi,

You can prevent anyone from connecting directly as root, either using rlogin or telnet, by configuring the /etc/securetty.
If you just put "console" in this file, you will be able to connect directly as root only from the console. Keep at least this entry.

To become root form other terminals, you will have to use the su(1) command.

greetings
benoit marc

[Steven W. Illgen]

One way is to create a .rhosts file in the user's home directory on the remote system. For instance, if user1 on system1 needs to rlogin to system2, create a .rhosts file in /home/user1 on system2 as follows:

system1 user1

This allows user1 to rlogin or remsh to system2.

In addition, to prevent anyone from using rlogin as root, do not configure a .rhosts file in the root directory.

Hope this helps.

[Jasmin Berube]

you have to remove "station?? root" entry in /.rhosts file, or delete this file. Users must be listed in this file to be able to do
rlogin.

[Albert E. Whale, CISSP]

Junior,

There are two files associated with rlogin on HP-UX, they are:

/etc/hosts.equiv and ~/.rhosts

If the mahine name and/or user root are in these files, then the rlogin door is opened for the root user.

to prevent root from rlogin access perform the following.

> /etc/hosts.equiv
(that is shorthand for:
cat /dev/null > /etc/hosts.equiv)
> ~root/.rhosts

that will eliminate rlogin access from any machine for the root user.

To prevent rlogin access for all users, then you'll need to check the entire server for .rhosts files for all users. If you find them, delete them and recreate them as the root user, securing them so the user cannto modify the file.

Hope that helps.

[Berlene Herren]

Comment out login in /etc/inetd.conf and
login in /etc/services (port 513). re-read inetd.conf with #inetd -c.

Berlene