Host Security  «Prev  Next»

Lesson 9 Controlling root login access
ObjectiveControlling the Root Login Process

Controlling Root Login Access

The root login is very powerful since several keystrokes can cause major problems. For example, rm *.* will delete everything in the directory in which the command is executed. For this reason, access to the root login should be limited to a small number of system administrators, and should also be limited to where it can be used. Although it may be convenient to remotely login as root, it is an easy way for a cracker to break in.

Why root remote login is bad

Remote root login presents an immediate line of attack on your machine.
There is no need for the cracker to gain access as another user. Since remote root login allows administrators to easily log in as root over the network, there is the real danger that a cracker might steal the password via dictionary attacks applied directly to the root account.

Allowing root login

You will need to make configuration changes to allow root logins only where absolutely necessary.
The file /etc/securetty lists those areas from which the root user may log in:
Consoles DESCRIPTION Recommendation for the /etc/securetty file
tty1 ... Direct virtual consoles (<Alt-><F1>) Leave available for problem solving
ttyS0 ... Serial consoles used by mgetty Should not be available
0 ... Virtual consoles Should not be available, otherwise root

Note, however, that even if you disallow root login from network connections, administrators who log in from the network will still be able to use the su (superuser) command to log in as root, potentially revealing the root password if a secure connection is not used. However, if you use OpenSSH, you can safely administer your machine remotely.
The following MouseOver shows you the contents of a typical /etc/securetty file.

  1. This command lists the contents of the /etc/securetty file
  2. This shows that the first direct virtual console is available
  3. This shows that the second direct virtual console is available
  4. This shows that the third direct virtual console is available.
  5. This shows that the fourth direct virtual console is available
  6. This shows that the fifth direct virtual console is available.
  7. This shows that the sixth direct virtual console is available
  8. This shows that the seventh direct virtual console is available
  9. This shows that the eigth direct virtaul console is available

Secure tty
The next lesson explains the use of the sudo command.