<br><font size=2><tt>Vincent Archer <varcher@denyall.com> wrote on
02/12/2007 04:51:07 AM:<br>
<br>
I don't speak for Sun, but here are some hints that might help.<br>
> <br>
> OS packaging person here (the guy who defines the exact stripped version<br>
> we install on customer appliance) did test with root, and it worked.
I<br>
> suspect it is dependent on whether root is enabled as allowed as a
<br>
remote<br>
> login or not (a setting I dimly remember being available on solaris
10<br>
> years ago, I think).<br>
<br>
For root login; there is a setting in /etc/default/login. If CONSOLE is
<br>
set, then root can only login<br>
on that device i.e. "CONSOLE=/dev/ttya" means "root"
can only login on <br>
ttya device. Any other user via<br>
telnet/ssh/whatever has to login as themselves and "su" to root.<br>
<br>
This doesn't prevent telnet -l "-fbin", or -flp; for those accounts
best <br>
bet is to change /etc/passwd for the shell of system-account users to <br>
/sbin/noshell or /bin/false (noshell just logs the entry and exists)<br>
<br>
Of course disabling in.telnetd in /etc/inetd.conf (and doing a pkill -HUP
<br>
inetd) if possible is a safe bet,<br>
but some sites are forced to use telnetd.<br>
</tt></font>
<br>
<br>
<br><font size=2 face="sans-serif">Brad Powell<br>
Sr. Security Manager<br>
Information Security and Risk Management.<br>
Global Information Services.<br>
Applied Materials Inc.<br>
Office 408- 563-1350<br>
<br>
The content of this message is Applied Materials Confidential. If
you are not the intended recipient and have received this message in error,
any use or distribution is prohibited. Please notify me immediately by
reply e-mail and delete this message from your computer system. Thank you.</font>