Re: [cobalt-users] Disallowing remote root login

["Marc Gear" <marcg@xxxxxxxxxxxxxx>]

> > ok, dropping user exec for su is a nice start...but remember
> > it's SUID not SGID ;)
> You, um, wanna shuffle those cards again a little slower, sir?

su runs as root, and as standard on the raq i think any user can run the
command, but pam stops anyone bar the wheel group from actually getting it
to work

 14 -rwsr-xr-x   1 root       root        13208 Jan 11  1999 /bin/su

you can stop non wheel users from even running the command by changing it to
the following:

 14 -rwsr-x---   1 root     wheel       13208 Apr 13  2000 /bin/su

with:
chgrp wheel /bin/su
chmod 4750 /bin/su

i think thats it, but dont hold me to that one :)

> Root and wheel groupmembers passwords are all strong. As of yet, I can
> ssh in from any IP but I'll be locking that one down too soon. (But
> since you mention it, how? ipchains or sshd_config?)

I think ssh uses its own wrappers, check the documenation otherwise use
tcp-wrappers.

--
/\/\ a R (