I want to prevent the root user from logging in directly from local console on a RHEL box, but allow login from ssh. Can this be done?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
An alternate configuration is also possible where a separate sshd that listens for root logins is only avaliable on
localhost& you use agent forwarding to log in as root. I know at least one major corporation that has that configuration, and it adds one more layer of security (and complexity).
Disabling local root login is bad idea. The access may be necessary in system crash situations. According to NSA RHEL 5 security guide, 220.127.116.11 Restrict Root Logins to System Console:
Direct root logins should be allowed only for emergency use. Innormal situations, the administrator should access the system via a unique unprivileged account, and use su or sudo to execute privileged commands. Discouraging administrators from accessing the root account directly ensures an audit trail in organizations with multiple administrators. Locking down the channels through which root canconnect directly reduce sopport unities for password-guessing against the root account.
Root should also be prohibited from connecting via network protocols.
Disabling root login from local console can be done by removing lines tty1 tty2 tty3 tty4 tty5 tty6 tty7 tty8 tty9 tty10 tty11 from /etc/securetty.