Root access

[MATHE]

Hello everybody,

My question is about the security and most particularly the root access to a HP-UX system.

I would like to know if it is possible (and then how) to decide who can become root? Is there a config file like /var/adm/cron.allow, but for the root access.
As a consequence, only the defined users could become root.
I hope it is clear.
Many thanks for your help.
Regards,

Eric.

[Bharat Katkar]

Hi,
Any user who wants to become root uses "su" command. If you control the Owner/Permission of the same then it is possible.
Also create /etc/securetty file and add "CONSOLE" to it so that direct root login is only possible thr' console other's have to use su to get root access.

Hope that helps,
regards,

[Sanjay Kumar Suri]

Any user with UID=0 in /etc/passwd has root powers.

sks

[Bruno Ganino]

Try with Modification of permission or with settings of password to /etc/passwd.
See man ...
chgrp chown
HTH
Bruno

[Michael Tully]

Beside using the UID of zero in the password file, which is an extremely bad idea, you can use 'su -' which will ask for a password to be entered. There are other ways of course to delegate root related tasks, these are from a 'restricted sam' and my favourite 'sudo'. There are many posts on both of these subjects. Take the time to review some of them. Access to the root password and root access should be treated with utmost caution.

[MATHE]

Many Thanks for your answers.
I'm going to check it.
Regards,
ERuc.

[Michael Tully]

One further thing. All attempts to use root from 'su -' are logged into /var/adm/sulog
You can also use this file to audit unsuccessful attempts as well. Using 'root' directly as a login, is a bad idea and should be discouraged by using the /etc/securetty file.

[Gary L. Paveza, Jr.]

If you're looking to limiit who can become root, you can put an entry in /etc/default/security such as:

SU_ROOT_GROUP=

Then only people who are a member of that group can su to root - even if the others know the password (provided you eliminate direct login of root).

Not only is this good for security, but it can prevent users from locking the root user ID due to login attempts because they were doing a su and mistyped.

[Bharat Katkar]

Eric.
Don't forget to assign points for replies those were helpful.
Refer the link below for more clarification.

http://forums1.itrc.hp.com/service/forums/helptips.do?admit=716493758+1085211538437+28353475#33

Don't mind. :))
Thanks,

Bharat

[Mark Grant]

Seems to me that there isn't a great deal of point in restricting the users that can su to root. If you restrict "su to root" to only userA then all you have done is made naughty userB have to run his/her password cracking code on userA's account first. Doesn't help too much.

Best not let anyone have root access if it's particularly important. Keep root password in an envelope in a safe. You then need human authorization (and a key) to access it.