where can I get related docs for /etc/securetty file?

[稀里哗啦]

I can't found it in man page.

[Sebastian Galeski_1]

Root access can be denied to any port on the system by the use of the
/etc/securetty file. If not present (the default), anyone who knows the
root password can login as root regardless of their location (modem,
DTC port, tty port, network login).

However, if the /etc/securetty file contains:

console
tty0p4
tty1p2

then root logins will fail "Login incorrect" if the user is not on the
3 ports listed in the above example. If the word console is not in the
/etc/securetty file then root login at the console is disabled! Any
attempt by someone on port tty0p1, etc will also fail, even though the
correct password has been supplied.

Creating this file should be done with caution. If the file has no
valid port names including console, root access is denied to *ALL*
users! There is no fix for this condition except:

1. login as a normal user
use the su command to attain root status

2. reboot in single user mode (600, 700, 800 only) or use the
recovery system (300, 400).

To protect /etc/securetty from user access, be sure to set the owner to
root and bin, and the permissions to 600 (rw for owner only).

hope it help You

[Mateja Bezjak · Accepted solution]

Hi,

You can find a little bit in the manual page for login.1

Here is the output from man login:
If the /etc/securetty file is present, login security is in effect.
Only user root is allowed to log in successfully on the ttys listed in
this file. Restricted ttys are listed by device name, one per line.
Valid tty names are dependent on the installation. An example is

console
tty01
ttya1
etc.

Note that this feature does not inhibit a normal user from using the
su command (see su(1)).

Regards,
Mateja

[Steve Steel]

Hi

From man login

If the /etc/securetty file is present, login security is in effect.
Only user root is allowed to log in successfully on the ttys listed in
this file. Restricted ttys are listed by device name, one per line.
Valid tty names are dependent on installation. An example is

console
tty01
ttya1
etc.

Note that this feature does not inhibit a normal user from using the
su command (see su(1)).


For such a problem you can always go to
www.docs.hp.com

There is an option
search this site

put in a word like securetty

get all info in the hp documentation

Steve steel

[T G Manikandan]

/etc/securetty is defined in the man page of login.

use #man login
to find out the information

Thanks

[Bill McNAMARA_1]

If you go to http://docs.hp.com/ and do a search for it, lots of docs are proposed.

Here's one that may be of interest:
http://docs.hp.com/hpux/pdf/B2355-90701.pdf

Later,
Bill

[Steven Sim Kok Leong]

Hi,

Center for Internet Security has a HP-UX security benchmark for HP-UX 10.20, HP-UX 11.00 and HP-UX 11.11:

http://www.cisecurity.org/bench_HPUX.html

Among the rules is one on /etc/securetty:

echo console > /etc/securetty
chmod 600 /etc/securetty

This prevents anonymous root logins except on the system console. The administrator should access the system via an unprivileged account through su or sudo etc. This provides an audit trail when things go wrong.

Hope this helps. Regards.

Steven Sim Kok Leong