Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have to configure to limit root direct access except system consoles. That is, the ways of telnet, ftp, SSH are all prohibited. Root can only login through console. I understand that will require me to configure the file /etc/securetty. I have to comment all the tty, just keep "console" in /etc/securetty.

But from google, I found many peoples said that configure /etc/securetty will not limit the way of SSH login.

From my experiment, I found it is. (configure /etc/securetty won't limit SSH login).

And I add one line in /etc/pam.d/system-auth: auth required pam_securetty

It seems root SSH login can be prohibited.

But I can't find the reason: What is the difference of configure pam_securetty and /etc/securetty? Can anyone help me with this? Only configure /etc/securetty could work? Or Have I to configure pam_securetty at the same time? Thanks a lot!

share|improve this question
up vote 2 down vote accepted

pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure" tty, as defined by the listing in /etc/securetty. pam_securetty also checks to make sure that /etc/securetty is a plain file and not world writable.

telnet and ftp call login, and you probably already have /etc/pam.d/login including pam_securetty

share|improve this answer
Jayen, thanks :-) – zhaojing Oct 15 '10 at 4:23
Yes, you are right, I checked /etc/pam.d/login, and it really include pam_securetty. Does that means, if without pam_securetty in /etc/pam.d/login, only configure /etc/securetty won't take effective? – zhaojing Oct 15 '10 at 4:24
that's right. you need pam_securetty in /etc/pam.d/whatever – Jayen Oct 26 '10 at 6:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.