We help IT Professionals succeed at work.

We've partnered with Certified Experts, Carl Webster and Richard Faulkner, to bring you two Citrix podcasts. Learn about 2020 trends and get answers to your biggest Citrix questions!Listen Now

x

Lock up root accout

JohnLucania
JohnLucania asked
on
Medium Priority
673 Views
Last Modified: 2013-11-17
How do you change the settings so that 'root' account can ONLY be used/accessed on the node consol?
It shouldn't be allowed that anyone uses 'root' account to access the node from remote sites.
Comment
Watch Question

Commented:
To disable remote login access for your root user, edit the /etc/security/user file. Specify False as the rlogin value on the entry for root.

Seems you have a lot of aix questions here...:)

Author

Commented:
I view:

/etc/security/user

default:
        admin = false
        login = true
        su = true
        daemon = true
        rlogin = true   ========> do you mean modifying this to 'False'?
        sugroups = ALL
        admgroups =
        ttys = ALL
        auth1 = SYSTEM
        auth2 = NONE
        tpath = nosak
        umask = 022
        expires = 0
        SYSTEM = "compat"
        logintimes =
        pwdwarntime = 0
        account_locked = false
        loginretries = 0
        histexpire = 0
        histsize = 0
        minage = 0
        maxage = 0
        maxexpired = -1
        minalpha = 0
        minother = 0
        minlen = 0
        mindiff = 0
        maxrepeats = 8
        dictionlist =
        pwdchecks =

root:
        admin = true
        SYSTEM = "compat"
        registry = files
        loginretries = 0
        account_locked = false
Commented:
Not this one. This is under the stanza of "default" which applies to every user id. What you want to is to add "rlogin = false" into the stanza of root since you don't have this entry in it.

So it shoud look like this:

.
.
.
root:
        admin = true
        SYSTEM = "compat"
        registry = files
        loginretries = 0
        account_locked = false
        rlogin = false
.
.
.

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts
CERTIFIED EXPERT

Commented:
It's been years, but I think disabling rlogins will not disable "any" TTY logins.  I think you set "TTY" to "/dev/tty0" or something.  Only necessary if there are TTYs apart from tty0, of course.
CERTIFIED EXPERT
Commented:
Sorry - that should have been:
  ttys = /dev/tty0
I think you can also do this via "smit security".
Commented:
This blocks users from telnet/rlogin:
# smitty
  ==> Security & Users
    ==> Users
      ==> Change / Show Characteristics of a User
        ==> User NAME                [root]
          ==> User can LOGIN REMOTELY                [false]

If you need to block logins from other serial terminals, you'll have to edit the "Valid TTYs" field from "ALL" to the name of your console device.

Rgds
-Sandy
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.