Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a CentOS machines and below I set this in my access.conf:

root : ALL 

Yet I can login via root and still perform tasks. So what is the job of access.conf then? Is there anything wrong done here?

share|improve this question
it is a way to manage access control. If you have multiple IP on your network then you may define the access for root/or user from specific IP in this file. Give it a try block the access for user root for your IP and try to access the server. Make sure that you have already opened another session before making the changes and logging out from the server so that you can revert back the changes. – Pratap Dec 31 '12 at 10:56
@PratapSingh I would like to clarify what does this means - : root : ALL. It means that root cant access from any ip am I right? So why is it that the root can still access here is where I am lost. – new14 Jan 1 '13 at 4:20
If you read the access.conf itself you would see you need to add + OR - before any access control declaration. – Pratap Jan 1 '13 at 7:28
@PratapSingh yes I have read it say if - you dont give access to root and ALL is from any ip right? Please correct me here. Thank you. – new14 Jan 1 '13 at 10:07
up vote 1 down vote accepted

Here you go and get to know how to activate access.conf

I did add following in my access.conf file

[root@lcoalhost ~]# tail -1 /etc/security/access.conf

I added the following in the file "/etc/pam.d/sshd"

[root@localhost ~]# head -3 /etc/pam.d/sshd
auth       include      system-auth
account    required   #I added this line in the file

Specially the 3rd line.

After editing this I tried accessing the server as user :user1:

This is what I saw in the log file "/var/log/secure"

Jan  1 16:40:06 localhost sshd[17981]: pam_access(sshd:account): access denied for user `user1' from `'
Jan  1 16:40:06 localhost sshd[17981]: Failed password for user1 from port 3186 ssh2
Jan  1 11:10:06 localhost sshd[17982]: fatal: Access denied for user user1 by PAM account configuration

Here "user1" has been denied from any IP. Similarly you can do it for any user.

Here is the log for root user

Jan  1 16:53:29 localhost sshd[19144]: pam_access(sshd:account): access denied for user `root' from `'
Jan  1 16:53:29 localhost sshd[19144]: Failed password for root from port 3356 ssh2
Jan  1 11:23:29 localhost sshd[19145]: fatal: Access denied for user root by PAM account configuration

Hope this helps.

share|improve this answer
I guess I miss the second part the pam setting which I have not done yet. So the pam settings must be done in order for access.conf to work am I right? I also saw this line in my pam auth required use_uid what does this do then is the same functionality? – new14 Jan 1 '13 at 13:16
Yes the pam settings must be enabled in order to get it working. Because it just scan the file in order it is given in the file. To know more about this you might need to do some search link. – Pratap Jan 1 '13 at 13:21
I would like to know the steps here.So first when I ssh into a machine the access.conf file will be scan and followed by pam is it? OR is the other way around? – new14 Jan 1 '13 at 14:36
Yes this is the way it works as per the details. – Pratap Jan 1 '13 at 16:18
I am lost which one is checked first the access.conf or pam.d? I guess is the pam right? So then pam will look for the access.conf? – new14 Jan 2 '13 at 2:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.