转自:https://www.cnblogs.com/diyunpeng/p/8403534.html
默认情况下,linux不允许root用户以telnet方式登录linux主机,若要允许root用户登录,可采取以下3种方法之一:
1、修改login文件
redhat中对于远程登录的限制体现在/etc/pam.d/login 文件中,如果把限制的内容注销掉,那么限制将不起作用。
#%PAM-1.0
auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
auth include system-auth
#account required pam_nologin.so
account include system-auth
password include system-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session include system-auth
session required pam_loginuid.so
session optional pam_console.so
# pam_selinux.so open should only be followed by sessions to be executed in the user context
session required pam_selinux.so open
session optional pam_keyinit.so force revoke
2、移除securetty文件
验证规则设置在/etc/security文件中,该文件定义root用户只能在tty1-tty6的终端上记录,删除该文件或者将其改名即可避开验证规则实现root用户远程登录。
[root@rhel ~]# mv /etc/securetty /etc/securetty.bak
3、修改securetty文件
[root@rhel ~]# vim /etc/securetty
console
vc/1
….
….
vc/10
tty1
….
tty11
pts/1
pts/2
….
….
….
pts/11
=====================================================
1、注释掉 /etc/pam.d/login中的auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so
2、查看log信息:tail /var/log/secure
tail /var/log/secure
Mar 17 02:16:55 localhost login: pam_securetty(remote:auth): access denied: tty ‘pts/3’ is not secure !
Mar 17 02:16:59 localhost login: FAILED LOGIN 1 FROM 192.168.160.1 FOR root, Authentication failure
根据“tty’pts3’ is not secure”的提示。添加 pts/ 系列终端到 /etc/securetty
pts/1
pts/2
pts/3 //增加这个应该是增加使用root登陆的个数
pts/4
pts/5
//也不知道有多少可以加,不能登陆就看log,如果不够再加好了。
此时,再重启telnet,便可以以root用户登录telnet服务器了。