linux root用户无法远程telnet登录原因-day40

2019-05-27

由于telnet远程登录是明文登陆，容易造成密码泄露，所以为了保护linux系统安全，所以禁止root远程telnet登录。修改相关配置文件可取消禁止。

虚拟机环境

m01(客户端)
外网IP 10.0.0.61
内网IP 172.16.1.61

查看telnet服务安装包
[root 16:17 @ m01 ~]# rpm -qa telnet-server
telnet-server-0.17-64.el7.x86_64

没有请安装
[root 16:26 @ m01 ~]# yum  install -y telnet-server

启动服务
[root 16:26 @ m01 ~]# systemctl restart telnet.socket

本地shell（windows系统登录）

[c:\~]$ telnet 10.0.0.61

Connecting to 10.0.0.61:23...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.

Kernel 3.10.0-957.el7.x86_64 on an x86_64
m01 login: root
Password: 
Login incorrect    #登陆错误

查看登录日志（虚拟机m01）

[root 16:32 @ m01 ~]# tail /var/log/secure
May 27 16:16:45 m01 login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/1 ruser= rhost=bogon  user=root
May 27 16:16:45 m01 login: pam_succeed_if(remote:auth): requirement "uid >= 1000" not met by user "root"
May 27 16:16:47 m01 login: FAILED LOGIN 1 FROM bogon FOR root, Authentication failure
May 27 16:16:52 m01 login: pam_securetty(remote:auth): access denied: tty 'pts/1' is not secure !
May 27 16:16:57 m01 login: pam_succeed_if(remote:auth): requirement "uid >= 1000" not met by user "root"
May 27 16:16:59 m01 login: FAILED LOGIN 2 FROM bogon FOR root, Authentication failure
May 27 16:29:23 m01 login: pam_securetty(remote:auth): access denied: tty 'pts/1' is not secure !
May 27 16:29:23 m01 login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/1 ruser= rhost=bogon  user=root
May 27 16:29:23 m01 login: pam_succeed_if(remote:auth): requirement "uid >= 1000" not met by user "root"
May 27 16:29:26 m01 login: FAILED LOGIN 1 FROM bogon FOR root, Authentication failure
[root 16:32 @ m01 ~]# 

重点

May 27 16:29:23 m01 login: pam_securetty(remote:auth): access denied: tty 'pts/1' is not secure !
May 27 16:29:23 m01 login: pam_unix(remote:auth): authentication failure; logname= uid=0 euid=0 tty=pts/1 ruser= rhost=bogon  user=root
May 27 16:29:23 m01 login: pam_succeed_if(remote:auth): requirement "uid >= 1000" not met by user "root"
May 27 16:29:26 m01 login: FAILED LOGIN 1 FROM bogon FOR root, Authentication failure

pam_securetty提示 access denied（拒绝访问）：tty pts/1 is not secure（终端 pts/1 不安全）。

pam_securetty

[root 16:43 @ m01 ~]# man pam_securetty


PAM_SECURETTY(8)                             Linux-PAM Manual                            PAM_SECURETTY(8)

NAME
       pam_securetty - Limit root login to special devices
-------pam_securetty -限制root登录到特殊设备
SYNOPSIS
       pam_securetty.so [debug]

DESCRIPTION
       pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure"
       tty, as defined by the listing in /etc/securetty. pam_securetty also checks to make sure that
       /etc/securetty is a plain file and not world writable. It will also allow root logins on the tty
       specified with console= switch on the kernel command line and on ttys from the
       /sys/class/tty/console/active.
-------pam_securetty是一个PAM模块，它只允许在用户以“安全”登录时根用户登录。
tty，由/etc/securetty中的清单定义。pam_securetty也进行了检查
/etc/securetty是一个普通文件，不能写。它还允许root登录tty
方法在内核命令行和ttys上进行切换/sys/class/tty/console/active.

查看/etc/securetty

[root 16:53 @ m01 ~]# cat /etc/securetty
console
vc/1
vc/2
vc/3
vc/4
...
...

hvsi2
xvc0
[root 16:53 @ m01 ~]# 

在配置文件/etc/securetty中添加pts/1

[root 16:53 @ m01 ~]# vim  /etc/securetty

  1 console
  2 pts/1
  3 vc/1
  4 vc/2
  5 vc/3
  ...
  ...
 38 hvsi1
 39 hvsi2
 40 xvc0
                       

重启telnet服务

[root 17:01 @ m01 ~]# systemctl restart telnet.socket
[root 17:01 @ m01 ~]# 

本地shell telnet登陆

[c:\~]$ telnet 10.0.0.61


Connecting to 10.0.0.61:23...
Connection established.
To escape to local shell, press 'Ctrl+Alt+]'.

Kernel 3.10.0-957.el7.x86_64 on an x86_64
m01 login: root
Password: 
Last failed login: Mon May 27 17:02:30 CST 2019 from bogon on pts/1
There were 10 failed login attempts since the last successful login.
Last login: Mon May 27 15:54:48 from 10.0.0.1
[root 17:02 @ m01 ~]# 

为了安全，可追溯，限制root用户远程telnet登陆去掉pts/1，恢复默认.

[root 17:01 @ m01 ~]# vim  /etc/securetty

  1 console
  2 vc/1
  3 vc/2
...
...
 37 hvsi1
 38 hvsi2
 39 xvc0