root access

[jedd]

hello everybody
i have a 11.00 box, i want to totally restrict
telnet access to root. i just want to limit root access on the console itself.how can i do this? also does anybody have any recommendations on readings,tips on how i can set up system accouting?
thanks so much for your help

[Michael Tully · Accepted solution]

Hi,

vi /etc/securetty
add the word 'console'
Save the file
This will restrict 'root' to only log at
the console

Three other things to mention

Have a look at these links

http://people.hp.se/stevesk/bastion11.html

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x67f9c6af36b7d5118ff10090279cd0f9,00.html
http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x4499e7e60861d511abcd0090277a778c,00.html

Set up sudo, you can get it here.

http://hpux.connect.org.uk/

-Michael

[Rob Galloway_1]

Look at this thread

http://forums.itrc.hp.com/cm/QuestionAnswer/1,11866,0x99268ffa98a2d5118ff10090279cd0f9,00.html

Rob

[Darrell Allen]

Hi Jedd,

Create /etc/securetty containing one line with the word "console" (no quotes). Root will then only be able to login on the console. You can still su to root from any terminal after you login as another user.

As far as accounting goes, I'
ve not used it. I do know you can enable auditing after converting to a trusted system but I haven't done so in some time. Sorry, no help there.

Darrell

[Rob Galloway_1]

Also to deny ftp access to the root user
create a file /etc/ftpusers which contains a line with 'root' in it.

regards
Rob

[Michael Tully]

Hi,

Here's a link to system accounting.

http://us-support2.external.hp.com/cki/bin/doc.pl/sid=d265050b185762cf4e/screen=ckiDisplayDocument?docId=200000046942429

Here's a link to auditing
http://us-support2.external.hp.com/iv/bin/doc.pl/sid=a406f2ba045f3954d2/screen=ivHome/?NODEID=English_SHW::WW_SW_NT_SECURITY_EN_E/Q1.1&WARP=1

HTH
-Michael