Root account controls

 Disabling the Root Shell

To prevent users from logging in directly as root, the system administrator can set the root account's shell to /sbin/nologin  in the /etc/passwd  file. This prevents access to the root account through commands that require a shell, such as the su  and the ssh  commands.

 

	Important
	Programs that do not require access to the shell, such as email clients or the sudo  command, can still access the root account.

Disabling Root Logins

To further limit access to the root account, administrators can disable root logins at the console by editing the /etc/securetty  file. This file lists all devices the root user is allowed to log into. If the file does not exist at all, the root user can log in through any communication device on the system, whether via the console or a raw network interface. This is dangerous as a user can Telnet into his machine as root, sending his password in plain text over the network. By default, Red Hat Enterprise Linux's /etc/securetty  file only allows the root user to log at the console physically attached to the machine. To prevent root from logging in, remove the contents of this file by typing the following command:

echo > /etc/securetty

 

	Warning
	A blank /etc/securetty  file does not prevent the root user from logging in remotely using the OpenSSH suite of tools because the console is not opened until after authentication.

 Disabling Root SSH Logins

To prevent root logins via the SSH protocol, edit the SSH daemon's configuration file (/etc/ssh/sshd_config). Change the line that says:

# PermitRootLogin yes

to read as follows:

 PermitRootLogin no

Disabling Root Using PAM

PAM, through the /lib/security/pam_listfile.so  module, allows great flexibility in denying specific accounts. This allows the administrator to point the module at a list of users who are not allowed to log in. Below is an example of how the module is used for the vsftpd  FTP server in the /etc/pam.d/vsftpd  PAM configuration file (the \  character at the end of the first line in the following example is not necessary if the directive is on one line):

auth required /lib/security/pam_listfile.so item=user \ sense=deny file=/etc/vsftpd.ftpusers onerr=succeed

This tells PAM to consult the file /etc/vsftpd.ftpusers  and deny access to the service for any user listed. The administrator is free to change the name of this file, and can keep separate lists for each service or use one central list to deny access to multiple services.

If the administrator wants to deny access to multiple services, a similar line can be added to the PAM configuration services, such as /etc/pam.d/pop  and /etc/pam.d/imap  for mail clients or /etc/pam.d/ssh  for SSH clients.

For more information about PAM, refer to the chapter titled Pluggable Authentication Modules (PAM) in the Red Hat Enterprise Linux Reference Guide.

The su  Command

Upon typing the su  command, the user is prompted for the root password and, after authentication, is given a root shell prompt.

Once logged in via the su  command, the user is the root user and has absolute administrative access to the system. In addition, once a user has attained root, it may be possible for them to use the su  command to change to any other user on the system without being prompted for a password.

Because this program is so powerful, administrators within an organization may wish to limit who has access to the command.

One of the simplest ways to do this is to add users to the special administrative group called wheel. To do this, type the following command as root:

usermod -G wheel <username>

In the previous command, replace <username>  with the username being added to the wheel  group.

To use the User Manager for this purpose, go to the Main Menu Button (on the Panel) => System Settings => Users & Groups or type the command redhat-config-users  at a shell prompt. Select the Users tab, select the user from the user list, and click Properties from the button menu (or choose File => Properties from the pull-down menu).

Then select the Groups tab and click on the wheel group, as shown below:

Figure 4-2. Groups Pane

Next, open the PAM configuration file for su  (/etc/pam.d/su) in a text editor and remove the comment [#] from the following line:

auth required /lib/security/pam_wheel.so use_uid

Doing this permits only members of the administrative group wheel  to use the program.

 

	Note
	The root user is part of the wheel  group by default.

 The sudo  Command

The sudo  command offers another approach for giving users administrative access. When a trusted user precedes an administrative command with sudo, the user is prompted for his password. Then, once authenticated and assuming that the command is permitted, the administrative command is executed as if by the root user.

The basic format of the sudo  command is as follows:

sudo <command>

In the above example, <command>  would be replaced by a command normally reserved for the root user, such as mount.

 

	Important
	Users of the sudo  command should take extra care to log out before walking away from their machines since sudoers can use the command again without being asked for a password for a five minute period. This setting can be altered via the configuration file, /etc/sudoers.

The sudo  command allows for a high degree of flexibility. For instance, only users listed in the /etc/sudoers  configuration file are allowed to use the sudo  command and the command is executed in the user's shell, not a root shell. This means the root shell can be completely disabled, as shown in Section 4.4.2.1 Disabling the Root Shell.

The sudo  command also provides a comprehensive audit trail. Each successful authentication is logged to the file /var/log/messages  and the command issued along with the issuer's user name is logged to the file /var/log/secure.

Another advantage of the sudo  command is that an administrator can allow different users access to specific commands based on their needs.

Administrators wanting to edit the sudo  configuration file, /etc/sudoers, should use the visudo  command.

To give someone full administrative privileges, type visudo  and add a line similar to the following in the user privilege specification section:

juan ALL=(ALL) ALL

This example states that the user, juan, can use sudo  from any host and execute any command.

The example below illustrates the granularity possible when configuring sudo:

%users localhost=/sbin/shutdown -h now

This example states that any user can issue the command /sbin/shutdown -h now  as long as it is issued from the console.

The man page for sudoers  has a detailed listing of options for this file.

The su  Command

Upon typing the su  command, the user is prompted for the root password and, after authentication, is given a root shell prompt.

Once logged in via the su  command, the user is the root user and has absolute administrative access to the system. In addition, once a user has attained root, it may be possible for them to use the su  command to change to any other user on the system without being prompted for a password.

Because this program is so powerful, administrators within an organization may wish to limit who has access to the command.

One of the simplest ways to do this is to add users to the special administrative group called wheel. To do this, type the following command as root:

usermod -G wheel <username>

In the previous command, replace <username>  with the username being added to the wheel  group.

To use the User Manager for this purpose, go to the Main Menu Button (on the Panel) => System Settings => Users & Groups or type the command redhat-config-users  at a shell prompt. Select the Users tab, select the user from the user list, and click Properties from the button menu (or choose File => Properties from the pull-down menu).

Then select the Groups tab and click on the wheel group, as shown in Figure 4-2.

Figure 4-2. Groups Pane

Next, open the PAM configuration file for su  (/etc/pam.d/su) in a text editor and remove the comment [#] from the following line:

auth required /lib/security/pam_wheel.so use_uid

Doing this permits only members of the administrative group wheel  to use the program.

 

	Note
	The root user is part of the wheel  group by default.

The sudo  Command

The sudo  command offers another approach for giving users administrative access. When a trusted user precedes an administrative command with sudo, the user is prompted for his password. Then, once authenticated and assuming that the command is permitted, the administrative command is executed as if by the root user.

The basic format of the sudo  command is as follows:

sudo <command>

In the above example, <command>  would be replaced by a command normally reserved for the root user, such as mount.

 

	Important
	Users of the sudo  command should take extra care to log out before walking away from their machines since sudoers can use the command again without being asked for a password for a five minute period. This setting can be altered via the configuration file, /etc/sudoers.

The sudo  command allows for a high degree of flexibility. For instance, only users listed in the /etc/sudoers  configuration file are allowed to use the sudo  command and the command is executed in the user's shell, not a root shell. This means the root shell can be completely disabled, as shown in Section 4.4.2.1 Disabling the Root Shell.

The sudo  command also provides a comprehensive audit trail. Each successful authentication is logged to the file /var/log/messages  and the command issued along with the issuer's user name is logged to the file /var/log/secure.

Another advantage of the sudo  command is that an administrator can allow different users access to specific commands based on their needs.

Administrators wanting to edit the sudo  configuration file, /etc/sudoers, should use the visudo  command.

To give someone full administrative privileges, type visudo  and add a line similar to the following in the user privilege specification section:

juan ALL=(ALL) ALL

This example states that the user, juan, can use sudo  from any host and execute any command.

The example below illustrates the granularity possible when configuring sudo:

%users localhost=/sbin/shutdown -h now

This example states that any user can issue the command /sbin/shutdown -h now  as long as it is issued from the console.

The man page for sudoers  has a detailed listing of options for this file.