Re: rlogin = true for root
From: Ian Northeast (ian_at_house-from-hell.demon.co.uk)
Date: 10/22/03
- Next message: Scott Wilson: "Re: I need help on formatting a file for my Unix class!!"
- Previous message: Alex007: "Re: system hacked, need help"
- In reply to: Sherman H.: "rlogin = true for root"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 22 Oct 2003 20:38:04 +0100
"Sherman H." wrote:
>
> I am reviewing AIX security and noted root account's rlogin was set to true
> in the passwd file. Does this have any security exposures? Is the root
> password encrypted when it is transmitted from a remote site? Would it be
> better to use su instead of root for remote login? Thanks.
The worst thing about that particular setting is accountability not
security. You can't tell who is logging in as root. It's fairly unusual
in modern systems to have so lax a default but this is AIX. IBM seem to
value compatibility with ancient versions higher than security. They
still ship sendmail configured as an open relay too:)
If you set it to false, and telnet in as another user then su, the root
password still goes over the network unencrypted. But you know who's
using root.
The most secure way is to:
Disable telnet and rsh completely and only allow ssh. Then everything
gets encrypted. Get the latest ssh from IBM, the one on the CD is
unsafe. IBM only produce ssh for 4.3.3 and 5.x (the currently supported
versions). If you have an earlier version you have to build it yourself;
Do not allow ssh as root. This is in the sshd configuration not the
account. Then you have accountability too.
Note to non-AIXers - the "rlogin=true" setting doesn't just control the
r* commands. It also controls whether root (or indeed any user it is
applied to) can log in with telnet.
Regards, Ian
- Next message: Scott Wilson: "Re: I need help on formatting a file for my Unix class!!"
- Previous message: Alex007: "Re: system hacked, need help"
- In reply to: Sherman H.: "rlogin = true for root"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
