I just installed a new Mandrake 9.1 box... during setup I chose the 'Higher' security setting (where 1 is least security and 4 is most I picked 3).
It won't let me login as root from the console. I can login as a normal user and 'su' to root but I can't login to root directly. I've never seen this before. I'm assuming it is part of picking 3, correct?
Yep, welcome to the world of msec, mandrake's modular security tool. It slices, it dices.. um, I mean, it has a lot of things it hardens so as to prevent people from breaking into your system. Actually, 5 is the highest level you can go. At level 5, everything is locked down and you as the administrator have to explicitly unlock what you want. I generally run my internet connected server at either 4 or 5 with custom modifications. Note also, that the lowest level is 0, which used to be called (in earlier mandrake versions) "Hello Crackers!" :-)
One of the things it does is to lock the root account from logging in. I believe, it does it by removing everything from /etc/securetty. Note, however, that if you add in a tty there, msec is run periodically out of cron to make sure everything stays hardened. If you want to change something, you need to go to /etc/security/msec/ and make local changes there. Look at /usr/share/msec/level.* for examples of what to change, and look at "man msec" for more info too.
As an example, this is part of what I have in my /etc/security/msec/level.local file:
from mseclib import *
accept_icmp_echo(yes)
allow_reboot(1)
set_user_umask('022')I believe this is just straight python. The first line imports all the msec stuff. The next line says to respond to pings. The third line says to allow local reboots by pressing ctrl-alt-del. The last line sets the user's umask. (You can also set root's umask with set_root_umask.)
In /etc/security/msec/perl.local I have the following:
/home/* current 711 /proc current 755
This lets things like apache get to the user's public_html directories (711) and let's anyone see proc.
Overall, msec is a very good way of making and keeping your system secure. If anything changes, it *will* change it back the next time it's run. That can be a little disconcerting at times, however, if you don't realize what's happening.
For your situation, if you really do want to allow root to login, you probably need to add something like this to /etc/security/msec/level.local:
allow_root_login(yes) allow_remote_root_login(yes)
Note that you can also set this:
allow_remote_root_login(without_password)
to only allow remote root logins with appropriate ssh keys.
Hope that helps some.
Cheers, Tanner -- Tanner Lovelace | lovelace(at)wayfarer.org | http://wtl.wayfarer.org/ --*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*-- GPG Fingerprint = A66C 8660 924F 5F8C 71DA BDD0 CE09 4F8E DE76 39D4 GPG Key can be found at http://wtl.wayfarer.org/lovelace.gpg.asc --*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*--*-- "What is this talk of "release?" We do not make software "releases." Our software "escapes" leaving a bloody trail of designers and quality assurance people in its wake." - [EMAIL PROTECTED]
pgp00000.pgp
Description: PGP signature
-- TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug TriLUG Organizational FAQ : http://trilug.org/faq/ TriLUG Member Services FAQ : http://members.trilug.org/services_faq/ TriLUG PGP Keyring : http://trilug.org/~chrish/trilug.asc
