Securing root access

vcheah · 12-05-2001, 10:24 AM

I was told that there is way to disable remote root access.
example .
when user telnet to <ipaddress>
user can only login with a normal user then su it to root.
but with telnet to <ipaddress>
and login as root . will be denied.

How can i set that up.?

thx in advance. for sharing

unSpawn · 12-05-2001, 11:28 AM

The file is called /etc/securetty. It lists the (virtual) consoles root is allowed to log in at.
Commenting out will disable a tty/virtual console, deleting the file will disable root logins completely.

Did someone already lecture you on the security problems you face when using telnet? :-]
I mean, even logging in and su-ing to root won't help, because *all* your communications tru telnet can be read.
I would like you to consider using Ssh/sshd if you value your box(en).

vcheah · 12-05-2001, 04:57 PM

But how to deny the telnet connection?
I have sshd and i always used it.. and telnet just running like normal is there anyway i can disable it?

acid_kewpie · 12-05-2001, 05:28 PM

edit the disable = no to yes in /etc/xinetd.d/telnet

unSpawn · 12-05-2001, 06:18 PM

...OTOH, if you're referring to this threads starting question, and so only want to deny *root* access to telnet:
Telnet doesn't send username "in advance" like ssh does (ssh -l username), so the server doesn't know who's overthere untill you provide a username to login with, so using a line like
"in.telnetd root@somehost"
in /etc/hosts.deny (for TCP wrappers-aware apps) wouldn work (right, anyone?).
Ok, so when connecting, telnetd "hands over" control to pam/login for authorization, and here pam kicks in (/etc/pam.d/login, first line) if no "ttyp*" lines are available in /etc/securetty, to deny a direct root login.

Just my 2K of worthless dot-com options.

vcheah · 12-23-2001, 02:28 PM

still doesn't work
i rename the securetty to securetty.bak for future usage
and change the /etc/xinetd.d/telnet - disable to yes
then telnet quetec- login root... still can login..

bluecadet · 12-23-2001, 03:03 PM

for a properly constricted root login, i'd recommend:

adding

Code:

account    required     /lib/security/pam_access.so

to /etc/pam.d/login, and then editing /etc/security/access.conf properly. the pam.d line forces all logins to be pushed through the access module, which is controlled by that conf file. I sussed this out as my housemates refused to change terminal to one dedicated to them when they wanted to check their mail, so i made it so it was impossible for them to log in on any other:

+:emma:tty4
+:katie:tty3
-:sarah:ALL EXCEPT LOCAL
-:cake:ALL

so emma can only log in on tty4, katie on tty3, sarah anywhere locally (cos she'd my fiance...) and then the last line defines the group their all in, and refuses login, if it login didn't get picked up already.