Define Restricted Logins

The following steps describe how to implement the "console-only" authentication as a primary authentication method. (It must run as a primary authentication method to enforce the restriction.) The steps describe how to make the authentication method known to AIX. Modify the root user's profile to invoke the validation routine and compile the "console-only" code.

The module, named console-only.c, determines if a user is signing onto the specified device (the default is the system console) or executing the su command. If either of these conditions are true, the routine returns a status value of zero. Otherwise, it returns a status value of one. If a status value of zero is returned, the login is validated and the user's initial program is executed. Invoke the validation routine, and compile the console-only code.

1. Edit the /etc/security/login.cfg file and add the following stanza to the file.

    
       CONSOLE: 
            program = /etc/security/console-only 
   

   This will make the method known to AIX.

   NOTE: The program console-only.c optionally takes one parameter to indicate a particular device to which root access is restricted. To specify a device other than the console, for instance "tty0", modify the CONSOLE stanza as follows:

    
       CONSOLE: 
            program = "/etc/security/console-only /dev/tty0" 
   

2. Now, change the root user's attributes to invoke the new authentication method when the root user attempts to log in. You can do this either from the command line or from SMIT:
   • From the command line, run the following: (This assumes that "SYSTEM" was the previous setting for auth1.)

      
         chuser auth1=SYSTEM,CONSOLE root 
     

     NOTE: There cannot be any spaces in the comma separated list of primary authentication methods.

   • To use SMIT, enter smit chuser. Then enter "root" for the user name. In the field PRIMARY authentication method, add "CONSOLE" to the comma separated list of primary authentication methods. For example, the field may now read SYSTEM,CONSOLE.

     NOTE: There cannot be any spaces in the comma separated list of primary authentication methods. Press Enter to commit the change.

3. Save the text below the console-only.c heading as console-only.c, and compile it with the following command:

    
        cc -o /etc/security/console-only console-only.c 
   

   NOTE: Please note that page headers and footers may appear in the code. They should be removed before the code is used.

4. Verify that the authentication method is working properly by attempting to login, su, rlogin, and telnet as the root user. If the user-defined authentication method is working properly, root logins will be allowed only on the console or the defined terminal.

 
    /*Console-only Root Login Authentication Method 
     * 
     *  Written By: John F. Haugh,II   Date: 18 March 93 */ 
     #include <sys/types.h> 
     #include <utmp.h> 
     #include <stdio.h> 
     #define CONSOLE "/dev/hft/0" 

NOTE: For AIX Version 4 replace the preceding line with the following line:

 
 define CONSOLE "/dev/lft0" 
/*console-only - TTY Port Access Control Authentication Method 
* 
*  console-only permits root logins on the console device 
*  (defined with the CONSOLE macro above).  It allows su's 
   from any device.  */ 
main (int argc, char **argv) 
{ 
        char     *user; 
        char     *console; 
        char     *tty, *ttyname (); 
        struct   utmp   utmp, *putmp; 
        /* Usage is "console-only <user>".  This would typically be 
         * only for root, but we allow other users to use this method. */ 
         if (argc < 2) 
                 exit (1); 
         user = argv[argc - 1]; 
         /* If there are 3 arguments, #2 is the name of the device.  */ 
         if (argc == 2) 
                 console = CONSOLE; 
         else 
                 console = argv[1]; 
         /* Get the TTY name.    */ 
         if ((tty = ttyname (0)) == (char *) 0) 
                 exit (1); 
         /* Clear the utmp structure so I can fetch this line's utmp 
          * record.      */ 
          memset ((void *) &utmp, 0, sizeof utmp); 
          strncpy (utmp.ut_line, tty + 5, sizeof utmp.ut_line); 
          setutent (); 
          putmp = getutline (&utmp); 
          /* See if my PPID is the same as the PID in the utmp record. 
           * That would mean that login is calling me.  This is what 
           * distinguishes between "login" and "su".     */ 
          if (putmp == (struct utmp *) 0 || putmp->ut_pid != getppid ()) 
                  exit (0); 
          exit ((strcmp (console, tty) == 0) ? 0:1); 
}