I have modified /etc/inittab file for changing default runlevel from 5 to 3 .
Now i can boot in terminal mode .However if i issue init 5 i get a X window.
How would i disable loading X? do i need to disable some services?
P.S.
What is Xvfb? How would i disable it?
My Distribution Details.
# lsb_release -a
LSB Version: :core-3.1-ia32:core-3.1-noarch:graphics-3.1-ia32:graphics-3.1-noarch
Distributor ID: EnterpriseEnterpriseServer
Description: Enterprise Linux Enterprise Linux Server release 5.2 (Carthage)
Release: 5.2
Codename: Carthage
# uname -a
Linux OFSMUW-VMGR-51 2.6.18-92.el5PAE #1 SMP Fri May 23 22:26:05 EDT 2008 i686 i686 i386 GNU/Linux
if the runlevel is 3 where is the problem? only root can change runlevel...
Stopping X services can lead to issues since some software rely on (oracleInstaller etc...). the same for Xvfb (if configured that is because I believe it does not run on its own...).
So either you stick to your int 3 default plan, or you remove the links in runlevel 5
Do you have in /etc a rc5.d directory? or a init.d directory? or rc.d/init.d directory? if so what is in it? ( I have no RH or centos linux to check...)
Just unlink the soft link, which you would be having for the X init, inside your default runlevel of /etc/init.d/rc5.d
This works pretty well but is considered a hard way of doing so.
Otherwise sophisticatedly, you may also wish to consider chkconfig utility. This is just a command line utility to add/delete an init script at an specified runlevel. Look google for its command usage. It�s a pretty simple one to use too.
As a Security practice I wanted to disable X from loading.
So i modified following line from /etc/inittab.
id:3:initdefault:
I was then able to start my machine in terminal mode(runlevel 3).
I wasn't satisfied at this stage as i was able to get the graphical console by merely typing
#init 5
So i search and find out that the reason for loading the graphical user interface was a script resided in
/etc/X11/prefdm
So i renamed it thinking OS will fail in finding it when invoked by inittab file .
To my surprise i was able to get the terminal back even if i hit #init 5
but then i realize i keep on getting following error lines.
INIT: cannot execute "/etc/X11/prefdm"
INIT: cannot execute "/etc/X11/prefdm"
INIT: Id "x" respawning too fast: disabled for 5 minutes
respawn
I found out the reason behind this was a line in /etc/inittab
x:5:respawn:/etc/X11/prefdm -nodaemon
(respawn The process will be restarted whenever it terminates)
Since the file prefdm was renamed and respawned the OS was keep on trying to execute it considering it is terminated.
Now i have made the above line commented and removed execute bit of the file .
System is now behaving as i wish it would.
Will it make any difference?
I m not using any application that explicitly use graphical user interface and i can work in runlevel 3.
So just comment out or remove the line from /etc/inittab then
---------- Post updated at 10:41 ---------- Previous update was at 10:20 ----------
And again "you was able to init 5", but the others on the box? can they do so?
I think you still havent learnt the main thing : ROOT is GOD in unix...
Anyone root can do what he wants, just look at you! You are not connected as ping are you? And second thing after that is never connect unless needed (maintenance) as root but use su/sudo or equivalent.
There is a way to secure a box in a way there is no root account: It by using RBAC, but I tell you, the day you forget the name/passwd of the account which can grant you root privilege, you are doomed...
You are right but then i just wanted to disable the display (I know root can enable it again).
and root can do anything but some security guides says you need to remove execute permissions for root as well(to prevent accidental executing of some commands).
This is just a precaution taken to avoid executing init 5 and getting into graphical mode by root.
Is there any good method other than this?
That is why you should not be connected as root, and always use root privilege to its strictly minimum, when absolutely necessary...
In other words, unless you are bringing down the server for maintenance (and so you are in front of the console) you should never see a root connection...
you cant avoid root to type init 5, but you could limit root access by not using it as described previously, the TRUE first precaution is to give root access only to people that are in charge of the system. Its not the root access that is dangerous its the person using it!
---------- Post updated at 12:39 ---------- Previous update was at 12:28 ----------
You could perhaps look if you cannot like in HP-UX let only people belonging to a choosen group to be allowed to su root (that will limit the access if someone unauthorized gets hold of root passwd...) and use sudo yourself without passwd ( in case you are stressed by hierarchy to connect "as" and looking over your shoulders...)
---------- Post updated at 13:04 ---------- Previous update was at 12:39 ----------
That said, I agree with you on one point:
I noticed that (HP-UX) although:
ant:/home/vbe $ more /etc/securetty
console
I noticed that someone distant can connect using X via XDMCP and connect as root...
And so I went through X config files to find a way of blocking... but again who has root passwd? (In my case I was fighting against "collegues" who do have root passwd and use it rather than using their own account and "su"...)
---------- Post updated at 16:15 ---------- Previous update was at 13:04 ----------
---------- Post updated at 16:21 ---------- Previous update was at 16:15 ----------
On my HP and IBM boxes I have a file : /usr/dt/config/Xstartup
copy it in /etc:
cp /usr/dt/config/Xstartup /etc/dt/config/Xstartup
# -> edit /etc/dt/config/Xstartup with vi,
# -> Add the following:
if [ $USER = root ]; then
exit 1
fi