Solved

Disable root telnet access in AIX

Posted on 2000-02-25
8
3,042 Views
Last Modified: 2010-05-18
Simple question, but I don't know AIX:

How do you disable root access via telnet in AIX 4.3.1?

Thanks!
0
Comment
Question by:edskee
8 Comments
 
LVL 20

Expert Comment

by:tfewster
ID: 2559612
Create an entry "root" in /etc/securetty; Any usernames in this file have to be logged in on a secure (not a networked) device.

You can still get root access remotely by logging in as yourself and using su.
0
 
LVL 2

Author Comment

by:edskee
ID: 2559655
Did that, that doesnt work in AIX
0
 
LVL 20

Expert Comment

by:tfewster
ID: 2559698
In the absence of a definitive AIX method:

Modify roots .profile, to add the following lines

if [ -n `ps -ef |grep $PPID |grep telnetd` ]
#i.e. connected by telnet
then
  echo "Cannot log in as root remotely"
  #exit 0
fi

After thorough testing, uncomment the "exit 0" line.

Note that this still allows su (and su -) and does not check for rlogin or rsh access;

 
0
 
LVL 2

Author Comment

by:edskee
ID: 2559856
I'll accept that as an answer if I cannot find a better way, but do you mean to tell me that AIX cannot do this and Linux can? I KNEW Linux was better! :P

Anyone got a real AIX way to do it? :)
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 15

Expert Comment

by:samri
ID: 2560235
Edskee,
       I'm really naive in AIX.  But in Solaris, there is a file in /etc/default called login (/etc/default/login).  You need to uncomment the entry that says CONSOLE=/dev/console.
       Perhaps you can check the same file in AIX.

Good luck,

Samri
0
 
LVL 20

Expert Comment

by:tfewster
ID: 2564316
From  the security manual on IBM's web site:

in /etc/security/user, set the root entry as follows
root:
      login = false
      su = true

I can't check this, because the only AIX system I have access to doesn't
allow (my) account to su to root.

I also found references to restricting remote logins using SMIT, but no definite
"How To"

Hope this helps
Tim
0
 

Accepted Solution

by:
cmcheline earned 20 total points
ID: 2565040
There are several ways to do this. Here are a couple of the easiest:

1) type "smit chuser" -> type "root" as the user to change -> modify  "User can LOGIN?" to false to disable login at the console ->  modify  "User can LOGIN REMOTELY?" to false to disable login from a telnet session -> press enter to accept changes

2) type "chuser login='false' rlogin='false' root"
0
 
LVL 2

Author Comment

by:edskee
ID: 2565313
Thanks much. Helped a lot.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In tuning file systems on the Solaris Operating System, changing some parameters of a file system usually destroys the data on it. For instance, changing the cache segment block size in the volume of a T3 requires that you delete the existing volu…
I have been running these systems for a few years now and I am just very happy with them.   I just wanted to share the manual that I have created for upgrades and other things.  Oooh yes! FreeBSD makes me happy (as a server), no maintenance and I al…
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.
In a previous video, we went over how to export a DynamoDB table into Amazon S3.  In this video, we show how to load the export from S3 into a DynamoDB table.

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now