root login at console

[Suresh M S R_1]

hi

i have a hp box running hpux 10.20 in trusted mode, as part of security we blocked root login frim terminals , but now i am not able to lgin as root from console also, can anybody help me in this

regards
Rajeev

[Elmar P. Kolkman]

Have you tried to su to root from a normal user?
/etc/securetty is probably your problem. But first test the su, then solve your problem.

[Suresh M S R_1]

hi

thanx for your replay, i am able to login using su . but a want to login directly as root from consol

thanx
rajeev

[Michael Tully]

What message(s) if any are you getting when you attempt to login from the console ?

[Suresh M S R_1]

hi

i am getting "login incorrect" mesg from consol as well as from other terminals.

thanx
rajeev

[Elmar P. Kolkman]

Check out /etc/securetty
It should contain console.

echo console >/etc/securetty
chmod 400 /etc/securetty

[Hoefnix]

Check also the contents from the file:
/tcb/files/devassign

Also check manpage of devassign.

Regards,

Peter

[Suresh M S R_1]

hi

thanx for the suggestions ,i will check this and get back to u

thanx
rajeev

[Umapathy S]

Suresh,
As said previously, /etc/securetty is the problem. For the entries in that file, direct root login is allowed. Make sure that it is not null.

HTH,
Umapathy

[Keith Bevan_1]

Rajeev,

The special file to restrict the location & use of the root account is :-

/etc/securetty

This file should have the permissions
-rwx------ , owned by root and group sys.

If you view this file whilst logged in as root or su from another location :-

pg /etc/securetty

it should contain the word console if you want to login as root from the console.

Additional info:

If you are using CDE (Common Desktop Environment) then make sure that console use is also not restricted in the following file :-

/etc/dt/config/Xstartup

Hope this helps.

Keith

[RAC_1]

If your password have special chars in it, (such as @ etc.)you may have problem logging in from console as root.

For a while mv /etc/securetty to /etc/securetty.bak.

Now telnet to machine and try loggin in with root. If this is working, try logging in from console as root, if you still get error, and you have special char in password, then change it(do not use special char)and try.

[Elmar P. Kolkman]

Anyone tried using a -B in root's passwd? ;-)

[Kent Ostby]

Elmar --

How about cntl-bRS in the password :-)

[Suresh M S R_1]

hi

the problem was with /etc/securetty only. i moved that file as securetty.org,then i am able to login as root. but when i added console in that file , login incorrect mesg is coming in console also , pls help

thanx
rajeev

[Patrick Wallek]

Do you have just the word 'console' in the file?

# cat /etc/securetty
console
#

If you have something like /dev/console then it will not work.

[Suresh M S R_1]

hi

i have inserted console in that file, and /dev/console is also there in the mechine.

than
rajeev

[Suresh M S R_1]

hi

so how can i restrict root to be accessed only from console, pls help

thanx
rajeev

[ConnieK]

Rejeev,

I have a feeling that the root account has been disabled. If you are attempting to log in at the console with VUE/CDE and this message appears, open up a terminal session instead of CDE. In other words, go to the console, right-click the button that says "Start Over". A drop-down menu will appear. Select the one that says "No Windows" and hit return. You should see a shell login prompt where you can login as root. This should correct your problem.

Connie K.

[Bill Hassell]

The securetty file CANNOT have a fullpath such as /dev/console. It must only have the word console. The security module prepends the word(s) in securetty with /dev/ so if you have /dev/console, then the 'approved' device is: /dev//dev/console and that will fail. Since you can use su, the root account is OK. I would start all over with your /etc/securetty file (in case there are special characters hidden in the problem file):

echo console > /etc/securetty

That should fix it.

[Suresh M S R_1]

hi all

thanx for your help , i added console in /etc/securetty using echo consloe > /etc/securetty and changed permissions to
-rwx------ , owned by root and group sys.

After this i restarted the mechine , it worked !!!!!!!

now i am able to login as root only from consloe

thanx again to all of u for the help


Rajeev