Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 454 / 848

Chapter 27. Console Access
428
27.2. Disabling Console Program Access
To disable access by users to console programs, run the following command as root:
rm -f /etc/security/console.apps/*
In environments where the console is otherwise secured (BIOS and boot loader passwords are set,
Ctrl
+
Alt
+
Delete
is disabled, the power and reset switches are disabled, and so forth), you may
not want to allow any user at the console to run
poweroff
,
halt
, and
reboot
, which are accessible
from the console by default.
To disable these abilities, run the following commands as root:
rm -f /etc/security/console.apps/poweroff
rm -f /etc/security/console.apps/halt
rm -f /etc/security/console.apps/reboot
27.3. Defining the Console
The
pam_console.so
module uses the
/etc/security/console.perms
file to determine the
permissions for users at the system console. The syntax of the file is very flexible; you can edit the file
so that these instructions no longer apply. However, the default file has a line that looks like this:
<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :[0-9]\.[0-9] :[0-9]
When users log in, they are attached to some sort of named terminal, which can be either an X server
with a name like
:0
or
mymachine.example.com:1.0
, or a device like
/dev/ttyS0
or
/dev/
pts/2
. The default is to define that local virtual consoles and local X servers are considered local, but
if you want to consider the serial terminal next to you on port
/dev/ttyS1
to also be local, you can
change that line to read:
<console>=tty[0-9][0-9]* vc/[0-9][0-9]* :[0-9]\.[0-9] :[0-9] /dev/ttyS1
27.4. Making Files Accessible From the Console
The default settings for individual device classes and permission definitions are defined in
/etc/
security/console.perms.d/50-default.perms
. To edit file and device permissions, it is
advisable to create a new default file in
/etc/security/console.perms.d/
containing your
preferred settings for a specified set of files or devices. The name of the new default file must
begin with a number higher than 50 (for example,
51-default.perms
) in order to override
50-
default.perms
.
To do this, create a new file named
51-default.perms
in
/etc/security/console.perms.d/
:
touch /etc/security/console.perms.d/51-default.perms