RSA Authentication

[Faizer Jameel]

Hi everyone
We are in the process of implementing RSA Key Authentication for our HP boxes. In this process all logins would require to key in the token to gain access to the. So I inderstand that this authentication would take over of all user related logins.
I have already secured root access only to the console and any other user who requires root neds to su.
In this situation what is the best prcatice for root. Should root be also included into this authentication mechanism or should root be exempted so that root could login thru the console to perform critical tasks.
Please advise
Thanks
Faizer

[Peter Godron · Accepted solution]

In my opinion, as long as the console is in a secure environment, root should be exempt from RSA.
Standard security policy applicable to root user needs to continue (Changing passwords, reviewing logs etc.)

[Steven E. Protter]

Shalom Faizer,

I agree with the previous post. The root user is limited to the Console, which is in a nice, air conditioned, locked room.

Even if its a network console device you can access from home via VPN your VPN can include a token as ours does.

At this point RSA for root is a little extreme. You are already at a best practice level of security unless you have a web console, which some shops don't like.

SEP

[Faizer Jameel]

Thankyou all.
I too was of the same opinion of not having root on RSA as the console is very secure in a A/c room under lock and key.
Thanks again
Faizer

[Larry Basford]

Keys for root is good for doing ssh,scp to run remove commnands to another server or transfer files securly. No passwords needed by sharing keys.

Shutdown ftp,telnet,rlogin,rsh and use ssh,scp to prevent from sending root passwords out on the network.