disabling su

In directory /etc/default, you should find a file called login which includes the following lines:

# If CONSOLE is set, root can only login on that device.
# Comment this line out to allow remote login by root.

#CONSOLE=/dev/console

As detailed, comment out (#) the line to allow root access from other terminals, otherwise leave it intact to disable root logins other than through the console. Hope this is what you require.

You probably need to protect the 'su' command itself.

Disallowing root login everywhere but the console (which should be physically protected) makes users log in as themselves, then become the superuser. This mechanism helps remote root loginsfrom becoming anonymous (since you don't know who logged in as root).

If you want to disallow su from user accounts you could chmod the su command so that regular users can't execute it. I would test this thoroughly before I placed it into production as it might affect the operation of normal applications.

hi,

If you really want to restrict root login through console then better change the permission of /usr/bin/su command from -r-sr-xr-x to -r-xr-xr-x and root sys .

that is remove setuid bit from su.

enjoy,

Dilip

This question was closed by the author