UNIX for Dummies Questions & Answers

Is there a difference between loging in as root directly and SU root from a regular users account.

If I disable the root login, will SU root have the same exact capabilities and power.

Yes, but if you want to be exactly as root, use :

Code:

su - root

or

Code:

su -

It is a good idea to disable root login and leave it available only from the console.

Yes. If you only do a "su root", that isn't the same as logging in as root or the same as "su - root". When you add the - option, it is as if the user actually logged in as root. Also, attempts (successful or not) in using the su command are logged to the sulog. Attempts to access the root account directly by signing in are not logged to the sulog (hopefully your server is set up to log that somewhere!).

If you disable the root login (as in locking the account), you won't be able to su to root. Instead, you want to disable root access except on console. This way, folks that are suppose to use the root account will need to su to use it - and that is logged. Or they will have to gain console to sign in as root instead of using their own account first but your console access should also be logged.

The setup of this matters on what OS you are using.

Thank you so much for the advice. I am using Soraris 7 and 8 and I meant to say su. Which defaults to root if there are no options? Our security personel is asking us to disable root logins and only have the cabability of su to root. That is why I was asking if the capabilities were exactly the same. I do remember trying things while on su -root and the system not allowing me to do some things. But mayby it's my inexperiance with UNIX.

For Solaris, edit /etc/default/login - make sure the line for CONSOLE is uncommented. It should look like this to disable root login from the network.
CONSOLE=/dev/console

Add root to /etc/ftpusers - this will disable using the root account with ftp.

Search the Internet for solaris and security - you will find many articles like this.