The Wheel Group Secure Terminals — Other Approaches

On the BSD platform, the terminal line configuration file etcttys defines secure terminals this file corresponds to the etcttytab file on SunOS. Both files are presented in greater detail in Chapter 11. The file lists all available system terminals. There must be an entry for every terminal port in use and arbitrary entries for unused ones. A terminal line entry has four fields: terminal−port command terminal−type status Each field is explained in the following table. Field Meaning terminal−port The name of the special file in dev that communicates with the line. command The command that init should execute to monitor this terminal line. getty For terminals and modems none To not create a monitoring process terminal−type The name of the terminal type described in etctermcap ; the TERM variable will be set to this value at login. status Zero or more keywords, separated by spaces: on Line is enabled off Line is disabled and the entry ignored secure Allow superuser root logins window = cmd Ò init should run cmd before the command specified in the field command A secure terminal is specified by the keyword secure in the statusfield for its entry. It is recommended to specify only the system console as secure, and never to give secure status to any modem or network terminals.

8.3.2 The Wheel Group

To become a superuser upon login on a nonsecure terminal means two passwords must be used: first the user password to login into a user account, and then the root password to switch to the superuser account. From security standpoint this is already quite an improvement. Generally, a switch to the superuser account can be accomplished from any user account. By using the wheelgroup, the number of users who may execute the switch to root can be restricted to only the members of this group. Members of the wheel group must be specified in the etcgroup file. In this way, the most sensitive security issue, superuser status user root, is additionally protected; only specific users one or more administrators may become the superuser from any given terminal.

8.3.3 Secure Terminals — Other Approaches

HP−UX 10.x introduced the file etcsecuretty, which defines secure terminals that allow direct superuser login. Usually, this is the console. Here is an example: cat etcsecuretty console 199 ls −l etcdefault total 26 −r−−r−−r−− 1 bin bin 12 Jan 8 15:08 cron −r−−r−−r−− 1 bin bin 10 Jan 8 15:08 fs −r−−r−−r−− 1 root sys 367 Jan 8 15:08 inetinit −r−−r−−r−− 1 root sys 462 Jan 8 15:27 init −r−−r−−r−− 1 root sys 678 Jan 8 15:08 kbd −r−−r−−r−− 1 root sys 1251 Jan 9 17:26 login −r−−r−−r−− 1 root sys 74 Jan 8 15:08 passwd −r−−r−−r−− 1 root sys 819 Jan 9 17:26 su −r−−r−−r−− 1 root sys 609 Oct 30 1996 sys−suspend −r−−r−−r−− 1 root sys 526 Jan 8 15:08 tar −r−−r−−r−− 1 root sys 16 Jan 8 15:08 utmpd The contents of the file are pay particular attention to the CONSOLE section: cat etcdefaultlogin ident login.dfl 1.7 930820 SMI SVr4.0 1.1.1.1 Set the TZ environment variable of the shell. TIMEZONE = EST5EDT Set the HZ environment variable of the shell. HZ = 100 ULIMIT sets the file size limit for the login. Units are disk blocks. The default of zero means no limit. ULIMIT = 0 If CONSOLE is set, root can only log in on that device. Comment this line out to allow remote login by root. CONSOLE = devco nsole PASSREQ determines if login requires a password. PASSREQ = YES ALTSHELL determines if the SHELL environment variable should be set ALTSHELL = YES PATH sets the initial shell PATH variable PATH = usrdtbin: usropenwinbin: usrucb: sharelocalbin SUPATH sets the initial shell PATH variable for root SUPATH = sbin: usrsbin: usrdtbin:usrope nwinbin: usrbin: usrucb: sharelocalbin TIMEOUT sets the number of seconds between 0 and 900 to wait before abandoning a login session. TIMEOUT = 300 UMASK sets the initial shell file creation mode mask. See umask1. UMASK = 022 SYSLOG determines whether the syslog3 LOG_AUTH facility should be used to log all root logins at level LOG_NOTICE and multiple failed login attempts at LOG_CRIT. SYSLOG = YES 200

8.4.1 Important Files for System Security