In this lesson, you will learn how to harden your server by enforcing different authentication requirements depending on whether a user is logging in via a physical terminal (TTY) or a remote network connection (SSH).
The Power of pam_securetty and pam_listfile
When dealing with high-security environments, you often want to ensure that "root" or other privileged accounts can only log in at the physical console (the actual monitor and keyboard attached to the server). Allowing remote root access via SSH is a significant risk, and PAM provides the tools to prevent this.
The primary module used for this is pam_securetty.so. By default, it checks /etc/securetty to see if a terminal is listed as "safe." If you are logging in via a network connection (like SSH), the system recognizes the connection isn't a secure TTY, and pam_securetty will fail the authentication, effectively barring that user from that specific login method.
Configuring Access Logic
To implement this, you edit files within /etc/pam.d/. For example, to restrict root login to physical consoles only, you would ensure the auth stack for your login service includes:
# /etc/pam.d/login
auth required pam_securetty.so
If you need more granular control—such as allowing specific users to access the system via network but not local TTYs, or vice-versa—you can use pam_listfile.so. This module allows you to reference an external file to permit or deny access based on the user or the terminal type:
# Deny access if the user is in /etc/network_denied_users when logging in remotely
auth required pam_listfile.so item=user sense=deny file=/etc/network_denied_users onerr=succeed
Why it Matters
By decoupling physical access from network access, you create a "defense-in-depth" architecture. Even if a user’s credentials are compromised, an attacker would still be unable to gain a session through a remote interface if you have explicitly configured your PAM stack to require a physical TTY for those specific user accounts. This provides a robust barrier against remote administrative takeovers.
Key Takeaway: Use pam_securetty to gate privileged access to physical consoles and leverage pam_listfile for flexible, identity-based restrictions on login entry points.