User log as Root

[meekrob]

Hi all ,
I want to know and to register the users that log on a HP9000 HPUX system ,
i have users that i don't want that they log as ROOT directly through telnet , i need them to log as their users and then do su - and log as root so i can identify them ,
so how can i block a user to log as root directly when promt to login ,
note that all these connections are done through telnet or ssh ,

[Robert-Jan Goossens]

Hi,

Simple answer, create the file /etc/securetty with the word console in it. Now root can only direct login from the console.

# echo console > /etc/securetty

Regards,
Robert-Jan

[Bill Hassell]

The second solution is better: download and install the sudo package. That way, users can be given SOME root privileges and will never need to know the root password.

[Aussan · Accepted solution]

put console in securetty to block direct telnet login as root

# echo console >> /etc/securetty

and add a group to the security file

in /etc/default/security

SU_ROOT_GROUP=mygroup

then the users who you want to su as root add them to mygroup, and they will be the only ones allowed to su as root

[Heironimus]

sshd uses the configuration directive "PermitRootLogin" in sshd_config for allowing or denying root logins via ssh. You need this in addition to /etc/securetty.

[Rahul Kumar Gupta]

Can u tell me abt this sudo package, from which site i can get it.

thnx

[Robert-Jan Goossens]

Hi Rahul,

Sudo is available for 11.11,11.23 and 11.31 from

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/sudo-1.6.8p12/

Regards,
Robert-Jan

[Geoff Wild]

For root history, we add the following in .profile so that each admin has their own history file - kind of a mini audit as well:

# Set up logging
HISTFILE=${HOME}/.sh_history_`who am i|awk '{ print $1}'`
date >>$HISTFILE
export HISTFILE
HISTSIZE=5000
export HISTSIZE


Rgds...Geoff