On 6/29/06, Bill Carlson <[EMAIL PROTECTED]> wrote:
I can think of only one reason to use the console on a HEALTHLY system, and that's assuming the system is secured correctly. And that would be to verify the root password.
.bx on id=soap In a former life we had inittab such that root would automatically be logged on at the 3270 console, and access to that console was protected by RACF LOGONBY authorisation and RACF password authentication (security approved). Normal access to the individual users on the system was through ssh cryptic keys only (no passwords). Support staff had sudo access to root to allow for auditing of their use of that special authorisation, and we could even remove the direct access to root through ssh. And we even had the public keys and access lists for sudo in LDAP for easy management to simplify security management. So no passwords in /etc/shadow. When things are broken beyond this, we would take the disks and mount them on another system to fix the problem. The great thing about this solution is that you separate access control from authentication. So you can take away someone's root access on a particular system without changing the root password and sending everyone mail about it (including the person who should not have it...). Looked great to me. However, the security guidelines in the company required passwords in /etc/shadow (including one for root) and they even had to expire after so many days. Even if you use cryptic keys for authentication, an expired password will stop you. And you can not change the password without knowing the old one (that we did not use). Big sigh. .bx off Rob ---------------------------------------------------------------------- For LINUX-390 subscribe / signoff / archive access instructions, send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit http://www.marist.edu/htbin/wlvindex?LINUX-390
