I have a CentOS machines and below I set this in my access.conf:

root : ALL 

Yet I can login via root and still perform tasks. So what is the job of access.conf then? Is there anything wrong done here?

  • it is a way to manage access control. If you have multiple IP on your network then you may define the access for root/or user from specific IP in this file. Give it a try block the access for user root for your IP and try to access the server. Make sure that you have already opened another session before making the changes and logging out from the server so that you can revert back the changes.
    – Pratap
    Dec 31, 2012 at 10:56
  • @PratapSingh I would like to clarify what does this means - : root : ALL. It means that root cant access from any ip am I right? So why is it that the root can still access here is where I am lost.
    – new14
    Jan 1, 2013 at 4:20
  • If you read the access.conf itself you would see you need to add + OR - before any access control declaration.
    – Pratap
    Jan 1, 2013 at 7:28
  • @PratapSingh yes I have read it say if - you dont give access to root and ALL is from any ip right? Please correct me here. Thank you.
    – new14
    Jan 1, 2013 at 10:07

1 Answer 1


Here you go and get to know how to activate access.conf

I did add following in my access.conf file

[root@lcoalhost ~]# tail -1 /etc/security/access.conf

I added the following in the file "/etc/pam.d/sshd"

[root@localhost ~]# head -3 /etc/pam.d/sshd
auth       include      system-auth
account    required     pam_access.so   #I added this line in the file

Specially the 3rd line.

After editing this I tried accessing the server as user :user1:

This is what I saw in the log file "/var/log/secure"

Jan  1 16:40:06 localhost sshd[17981]: pam_access(sshd:account): access denied for user `user1' from `'
Jan  1 16:40:06 localhost sshd[17981]: Failed password for user1 from port 3186 ssh2
Jan  1 11:10:06 localhost sshd[17982]: fatal: Access denied for user user1 by PAM account configuration

Here "user1" has been denied from any IP. Similarly you can do it for any user.

Here is the log for root user

Jan  1 16:53:29 localhost sshd[19144]: pam_access(sshd:account): access denied for user `root' from `'
Jan  1 16:53:29 localhost sshd[19144]: Failed password for root from port 3356 ssh2
Jan  1 11:23:29 localhost sshd[19145]: fatal: Access denied for user root by PAM account configuration

Hope this helps.

  • I guess I miss the second part the pam setting which I have not done yet. So the pam settings must be done in order for access.conf to work am I right? I also saw this line in my pam auth required pam_wheel.so use_uid what does this do then is the same functionality?
    – new14
    Jan 1, 2013 at 13:16
  • Yes the pam settings must be enabled in order to get it working. Because it just scan the file in order it is given in the file. To know more about this you might need to do some search link.
    – Pratap
    Jan 1, 2013 at 13:21
  • I would like to know the steps here.So first when I ssh into a machine the access.conf file will be scan and followed by pam is it? OR is the other way around?
    – new14
    Jan 1, 2013 at 14:36
  • Yes this is the way it works as per the details.
    – Pratap
    Jan 1, 2013 at 16:18
  • I am lost which one is checked first the access.conf or pam.d? I guess is the pam right? So then pam will look for the access.conf?
    – new14
    Jan 2, 2013 at 2:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .