Very Computer

How can I disallow root logins from a telnet connection?

TIA.

--

Kertis Henderson

man login.  /etc/securetty.

--
Allin Cottrell
Department of Economics
Wake Forest University, NC

create/edit the file /etc/securetty with the following (see the securetty man
page)

tty1
tty2
tty3
tty4
tty5
tty6
tty7
tty8

My RH5.0 system came this way by default and does not allow root to login via
telnet. However, with a normal account, shell, and password, nothing stops you
from logging in as a regular user and the su'ing your way to full power.

How can I allow root logins from telnet? If I want to allow root login from
192.168.0.2, what should I write to securetty? I just tried

tty1
tty2
...
tty7
tty8
192.168.0.2

but server rejects root login from 192.168.0.2.

It's generally not a good idea, and is why securetty exists.. so that only
the tty's in securetty can have root logins. If you want to be able to use
root from telnet, use the su command.

Quote:> tty1
> tty2
> ...
> tty7
> tty8
> 192.168.0.2

> but server rejects root login from 192.168.0.2.

That's because 192.168.0.2 is an IP, not a tty.

--
"In chaos and riots, the screech of machines |  This space dedicated to
 No right and no wrong and no in between     |    apocalyptic hamsters.
 Fall one by one, the queen to her fool      +-----------------------------
 Dos dedos mis amigos - everything's cool" -Everything's Cool by PWEI

Detective work:  Try telnetting in as a regular user and do "w".
What do you see?  This is your clue as to what to add to
/etc/securetty if you really want to telnet in as root.  An
IP number won't work.  Much better, however, if you want remote
asscess as root, to use ssh (Secure Shell).

--
Allin Cottrell
Department of Economics
Wake Forest University, NC

Quote:>How can I disallow root logins from a telnet connection?

modify your /etc/securetty file as other people have suggested.
Additonally, edit your /etc/hosts.allow and  /etc/hosts.deny files,
which are a good first line defence against security attacks.
Example:

/etc/hosts.deny:
ALL: ALL

/etc/hosts.allow:
.att.net, .ibm.net, somemachine.cool.net

the above 2 files mean that logins for any user would only be allowed from
any machine in the .att.net domain or .ibm.net domain, as well as a
specific machine named somemachine.cool.net.  Modify this to your own
needs.