Restrict direct login for root

[x4lewis]

My policy states that root account can only be accessed through the SU command, and that root access should only be done on the console. To do these:

I need to refuse direct root access at the console and all other ttys. I have yet try this and hope to ask if the appending "ttys=!ALL" to the /etc/security/user file works.

The rlogin/telnet is explicitly allowed in my environment, so anyone can potentially su to root. Can it be controlled? I guess it cannot. One workaround is to limit the users and so limiting the risks, by specifying sugroups=admin_group in the /etc/security/user file.

Any comments are welcomed.

 

[Guest_imported]

Refuse root login at the console also? What if your system is really locked up and you have only option of logging in as root to reboot?

Safe policy is to allow root via su only for all ttys except console. ANd this is why under all UNIX there is mechanism to do this but not restrict root at console.

 

[d3funct]

If you're using IBM AIX as your UNIX OS then just go into smit > users >change/show user type root for the username to change/show and go down the list until you see where it says "can login remotely?" and say no. This will restrict root from doing any telnet, or remote commands (rsh,rlogin,rcp etc..) You will be able to login at the console as root, no need to worry about the system locking up and not being able to get in, you can go in from the console hooked up to the server. Hope this helps.

Additionally, though a note of SECURITY caution, you could create one account with a uid of 0 same as root who can 'su' and only provide the password to sysadmins who need it, or use the sudo program.

Hope this helps
Jon Zimmer
jon.zimmer@pf.net
The software required `Windows 95 or better', so I installed Linux.

 

[MikeLacey]

"create one account with a uid of 0"

Hmmmmmm -- our audit team would rip you limb from limb, and enjoy it......
Mike
michael.j.lacey@ntlworld.com

 

[d3funct]

I'm just telling you of a suggestion I read in an AIX RS6000 system Administration manual. I didn't say I'd do it or that I did it, and I added the note of caution where security is concerned.
Jon Zimmer
jon.zimmer@pf.net
The software required `Windows 95 or better', so I installed Linux.