Subject: Re: telnet acces for root ?

From: "Adam Heath" <[email-masked]>
Date: Sat, 17 Aug 1996 19:24:51 -0400

----------
> > >I've set up a test PC with Debian 1.1 and want to 
> > >administer it remotely but am refused a telnet connection 
> > >as root ... is there a way around this ?  Do I have to give 
> > 
> > 
> > The way I handle this problem is log in under my account and type
> > 
> >         su root
> > 
> > Then it'll ask for the root password and bada-bing! You're root.
> > 
> > Hope this helps!
> > Tim
> > 
> 
> I use a program called "op" that works like "super".  Its
> not quite as quick as "bada-bing" its more like "bada-bing
> bada-boom" but there's much to be said about this mechanism.
> 
> It provides accountablility, more granular control over
> rootly power, etc.
> 
> Bye ...
> 
This is all nice and good, but there is a better way.

==============
/etc (2)$ cat secur*
# /etc/securetty: list of terminals on which root is allowed to login.
# $Id: securetty,v 3.0 1994/09/09 03:38:19 imurdock Exp $

tty1
tty2
tty3
tty4
tty5
tty6
tty7
tty8
ttyp0
ttyp1
ttyp2
ttyp3
ttyp4
ttyp5
ttyp6
ttyp7
ttyp8
ttyp9
Date => Sun Aug 18 11:06:33 EDT 1996
/etc (3)$ who
root     ttyp0    Aug 18 11:06 (adam.hackers-net)
Date => Sun Aug 18 11:08:15 EDT 1996
/etc (4)$
==============
I used telnet in Win95 to access linux, and cut and pasted this output
into here.

The ttyN are the function key terminals.  ttypN are for telnet.

Have fun!

---

From: [email-masked] (Ervin D. Walter)
Date: Fri, 23 Aug 1996 10:21:47 -0500

> This is all nice and good, but there is a better way.

[bad way deleted]

There is a reason that that /etc/securetty does not contain the pseudo
terminals in the first place.  It is very unsecure to allow root to
login directly anywahere except the console or possibly a computer
right next to the console.  Now, the above method is fine if your
computer is only part of your personal LAN that no one else has access
to and if your computer is never connect to the internet (unless you
disallow telnets with /etc/hosts.deny|allow).  There are mean people
who will try to hack your machine even during the 10 minutes that your
computer is on the internet via a PPP/SLIP dynamic IP account.  It
gets even more likely if you have any kind of permanent connection to
the world.  I would even not trust your collegues if you have a
moderatly large LAN where you are not the only user.

It's your choice, but...

Its saffer to log on as a normal user and su.

Erv

-- 
                                ____
----==-- _                     / /  \         
---==---(_)__  __ ____  __    / / /\ \	                  - Erv Walter
--==---/ / _ \/ // /\ \/ /   / /_/\ \ \             - [email-masked]
-=====/_/_//_/\_,_/ /_/\_\  /______\ \ \  - [email-masked]
   http://www.linux.org     \_________\/