When someone logs in, the file access.conf is scanned for the first entry that matches...
User root should be denied to get access from all other sources.
- : root : ALL
Quoted from the manpage
In my opinion that's just wrong. root should definitely be allowed to log in when a user has physical access to the box.
I do count IPMI as physical access, if you don't want that unplug the cable, it's the only way to be sure that you do have to stand in front of the box to have the equivalent of physical access. In some environments I even have the tendency to have a root terminal running without the need to log in -- given that proper access control to the facility is in place.
Why: sudo might fail, and giving the root password to a bunch of people so that they can login just generates problems, you'd have to change the password quite often in larger teams since there'll always be fluctuation. With an "open" root terminal there are no password worries -- all under the assumption that proper access control is there and that IPMI access is secured as well with personalized accounts
(No go downvote me for that, I can imagine that there are a ton of reasons against that but I find that to be a better -- more practical -- solution than to have a password policy for root which will sooner or later be forgotten. And if you then do need root access you have to jump in squares to get the "Password of the day")