Subject: telnet acces for root ?

From: "David J. Evans" <[email-masked]>
Date: Thu, 15 Aug 1996 13:08:13 +0100 ()

I've set up a test PC with Debian 1.1 and want to 
administer it remotely but am refused a telnet connection 
as root ... is there a way around this ?  Do I have to give 
root privs. to a named user or can I enable telnet 
connections as root ?

The machine normally has no screen or keyboard - hence the 
need for telnet access !

Thanks in advance

David 

______________
David J. Evans
AMS, Virology Research Group, The University of Reading
Whiteknights, P.O. Box 228, Reading RG6 6AJ
Tel : +44 (0)118 9318893  Fax : +44 (0)118 9316537
http://skpc10.reading.ac.uk/

---

From: Steffen Mueller <[email-masked]>
Date: Thu, 15 Aug 1996 16:21:45 +0200 (MET DST)

On Thu, 15 Aug 1996, David J. Evans wrote:

Hi Davis,

> root privs. to a named user or can I enable telnet 

This is done intentionally since offering direct root access via telnet is
considered a security holw. 

You either could use your normal login accound and then su to root or you
could ENABLE the root access via telnet.

Lease have a look to /etc/securetty where all ttys are listed thru which
root login is allowed.

> The machine normally has no screen or keyboard - hence the 

That's okay but personally I only allow root access thru the console and
su via my normal account.

Greetings,

Steffen
-----
Steffen R.Mueller               __  ___ _       _     email: [email-masked]
NTG Netzwerk und Telematic GmbH \ \/ / (_)_ __ | | __ fax  : +49 721 9652 210
Geschaeftsbereich Xlink          \  /| | | '_ \| |/ / phone: +49 721 9652 211
Vincenz-Priessnitz-Str. 3        /  \| | | | | |   <  RIPE : SM25-RIPE
D-76131 Karlsruhe, Germany      /_/\_\_|_|_| |_|_|\_\ WWW.Xlink.net/~steffen

---

From: Andre Koopal <[email-masked]>
Date: Thu, 15 Aug 1996 16:27:16 +0200

> The machine normally has no screen or keyboard - hence the 
Try to never log in directly as root, because you can make mistakes, and
you don't know who performs the tasks. Log in as yourself and then use
su to gain root-privs.

Regards,

Andre Koopal

---

From: "Heiko R. Selber" <[email-masked]>
Date: Thu, 15 Aug 1996 17:11:06 +0200 (MET DST)

> root privs. to a named user or can I enable telnet 

I think it's a good idea not to let a privileged user log in (just in case
there is a security hole somewhere). 

You can always telnet in as a normal user and use 'su' in order to get
root privileges. Like this: 

**** BEGIN TELNET EXAMPLE ****
beta:~$ telnet rudi
Trying 141.14.130.66...
Connected to rudi.RZ-Berlin.MPG.DE.
Escape character is '^]'.

Linux 1.2.13 (rudi.RZ-Berlin.MPG.DE) (ttyp4)

rudi login: hok
Password: 
Last login: Thu Aug 15 09:57:28 from :0.0
Linux 1.2.13.

Endless Loop: n., see Loop, Endless.
Loop, Endless: n., see Endless Loop.
                -- Random Shack Data Processing Dictionary
Du bist mir doch der liebste, Heiko !
rudi:~$ su -
Password:

Welcome, your Highness!
rudi:~# 
**** END TELNET EXAMPLE ****

Heiko
-----------------------------------------------------------------------------
Heiko Selber (Fritz-Haber-Institut Berlin)   | Vs lbh pna ernq guvf       |
http://www.fhi-berlin.mpg.de/~selber         | lbh unir jnfgrq lbhe gvzr. |
email: [email-masked]              | Urvxb Fryore               |
Phone:+49-30-8413-4574, Fax:+49-30-8413-4686 |____________________________|

---

From: [email-masked] (Ervin D. Walter)
Date: Thu, 15 Aug 1996 10:26:02 -0500

> The machine normally has no screen or keyboard - hence the 

As a general rule, root should only be used for the actual
administrating commands and not for things like reading email, news,
etc...  So, most people (that I know of) that administer from afar do
something like the following.  Each person that administrates (or just
you if you like) has a real account that they telnet to.  From that
account they su to root anytime they need to be superuser.  That means
someone must crack your password *and* root's password before they get
complete access to your system.  That is why root login is disabled
from telnet by default.  It is also a good idea to have mail to root
redirected to your real account so that root never has to read mail
either.

Good Luck,
Erv

-- 
                                  ,,,
                                 (o o)
-----------------------------oOOo-(_)-oOOo-----------------------------
Different all twisty a of in                         - [email-masked]
maze are you, passages little.              - [email-masked]

PGP Key fingerprint =  A5 AB 25 7D 7A FD 4D FE  BE 21 47 60 0C DC 67 9E

---

From: "Brian C. White" <[email-masked]>
Date: Thu, 15 Aug 1996 11:32:13 -0400

> root privs. to a named user or can I enable telnet

Generally, it is better for people to login with their regular
id and then either do "su -" or use 'sudo' for privalidged work.
The reasoning behind this is that "root" is a known user and
thus more vulnerable to cracking attempts over the net.  By
forcing login with a regular userid, a cracker must first learn
that userid and then crack two passwords to get root access.

                                        Brian
                               ( [email-masked] )

-------------------------------------------------------------------------------
    In theory, theory and practice are the same.  In practice, they're not.

---

From: Sherwood Botsford <[email-masked]>
Date: Thu, 15 Aug 1996 12:26:05 -0600

> redirected to your real account so that root never has to read mail

The flip side of this is that you may prefer to create secure
root passwords, and put appropriate /.rhost entries on these
machines.  Otherwise your password is running across the net
for any packet sniffer to slurp.

Of course if your master machine is compromised, then so are the others.

IMHO the login is user then su isn't a viable method unless you are
aslo using some form of secure telnet, or one time keys, or kerberos.

Sherwood Botsford |Unsolicited email that advertises commercial 
Physics Dept      |activities will consitute a request for 
U of Alberta      |spellchecking of all words of less than three 
Edmonton, AB,     |characters.  I charge $US500 for this service. 
T6G 2J1		  |There is no warranty of correctness of this service.