I know that I can prevent root from logging in via ssh with /etc/ssh/sshd_config but the auditors also want to see it done in /etc/security/access.conf as well.

It seems doable but I can't determine the correct syntax or order?

To test I am permitting root login in /etc/ssh/sshd_config and then attemptig to login via ssh.


When someone logs in, the file access.conf is scanned for the first entry that matches... User root should be denied to get access from all other sources.

- : root : ALL

Quoted from the manpage

In my opinion that's just wrong. root should definitely be allowed to log in when a user has physical access to the box.

I do count IPMI as physical access, if you don't want that unplug the cable, it's the only way to be sure that you do have to stand in front of the box to have the equivalent of physical access. In some environments I even have the tendency to have a root terminal running without the need to log in -- given that proper access control to the facility is in place.

Why: sudo might fail, and giving the root password to a bunch of people so that they can login just generates problems, you'd have to change the password quite often in larger teams since there'll always be fluctuation. With an "open" root terminal there are no password worries -- all under the assumption that proper access control is there and that IPMI access is secured as well with personalized accounts

(No go downvote me for that, I can imagine that there are a ton of reasons against that but I find that to be a better -- more practical -- solution than to have a password policy for root which will sooner or later be forgotten. And if you then do need root access you have to jump in squares to get the "Password of the day")

  • Are there any services that I would need to restart after making that change? I have tried adding that line to my access.conf file and I am still able to log int remotely via ssh as root. This is the only line in my access.conf file that is not a comment.. – ckliborn Jun 8 '11 at 21:46
  • This may be helpfu: cyberciti.biz/tips/… -- access.conf doesn't do anything to ssh itself. But you can use pam to make sure root doesn't get any access. You better play with that on a virtual machine before doing it on the real server. You'll effectively be locking root out (and by test I mean try sudo and or with the configuration so that you will still have some way of root access) – serverhorror Jun 8 '11 at 21:52

isn't securetty the obvious way to do this instead? (access.conf depends on whether PAM is in use via SSH, which it may not be.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.