securetty

[dongming]

hello
i try to deny remote root login. so i add console to /etc/securetty.
so root cann't login by telnet and rlogin.

but i try to login by /usr/bin/X11/xterm -display @d from exceed xstart, it still open root shell.
it use rexec.

does any one know how to configure this .(i still let other account to use rexex)

thanks

[Geoff Wild]

Do you have an .rhosts file?

Also see this thread:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=123810

Rgds...Geoff

[Devesh Pant_1]

Dongming,
I think if you get rid of the .rhosts or check your /etc/hosts.equiv file and deny remote execution on your box this will stop.

do a man on hosts.equiv and man .rhosts for more details.

thanks
DP

[dongming]

Thanks for response.
i test on my box, and i don't think it relate to .rhosts and host.equiv.
i remove both of these 2 file , and client (PC) can still login by root.

[Devender Khatana]

Hi,

It relates to these files only. Notice that there should be multiple .rhosts file for different users. So look for a .rhosts or hosts.equiv file in the home directory of the user.

HTH,
Devender

[dongming]

thanks
however, there is no .rhosts or host.equive under other user account.
if i change to rsh for xterm, it cann't login . but not for rexec.
so i have to comment the entry for rexed in /etc/inetd.conf

[Mel Burslan · Accepted solution]

rexecd seems like circumventing the use of securetty restrictions. I have tested on my most secure box in my data center, for which I have the root password but not use it daily, and it was a smooth sailing. pop goes the root prompt as soon as I typed the correct password.

disabling rexec is actually a good security practice. If I were you, I would disable rsh and telnet as well and require my users to get used to ssh idea.

[DCE]

The way we resolved this issue was to customize Xstartup. Xstartup is run by anyone coming via graphical connection.

We placed a logical test in the file to see if the id logging in was root (or oracle), and if so abort the login.

The original file is in /usr/dt/config. If you customize it, place the customized version in /etc/dt/config

[dongming]

thanks.
yes, it is good idiea to comment rsh, telnetd on /etc/inetd.conf and use ssh.
but sometime , we still use rcp.
about the Xstartup, only deny remote CDE login , not for xterm (rexec)

[Sameer_Nirmal]

Yes you are Right. You have to disable exec service in /etc/inetd.conf file.

Remember /etc/securetty is valid for tty
sessions only . It doesn't valid to exec , ssh sessions as they don't use ttys at all.

.rhost and host.equiv files are never used by rexec (but remsh does). It simply uses same authentication method as login does.

If you are using ssh and dont want to allow root login from ssh client , then set PermitRootLogin=no in /opt/ssh/etc/sshd_config file.

[dongming]

thanks everyone.
now it is clear.

[Devender Khatana]

What about assigning points to the responses to your posts according to their relevance.

Here are the questions for which you require to do this.

http://forums1.itrc.hp.com/service/forums/pageList.do?userId=CA1276111&listType=unassigned&forumId=1

Regards,
Devender

[dongming]

i assgin the point for all answer.
thanks again

[Devender Khatana]

Hi,

The points are still not alloted for any of the response to your questions. Your profile also tell this here

http://forums1.itrc.hp.com/service/forums/publicProfile.do?userId=CA1276111&forumId=1

Regards,
Devender