While securing a computer it is possible to lock oneself out so that the only recovery is to reboot into console mode. In some cases you will need a bootable CD. In the worst case with a locked down BIOS, you may not be able to easily do that either.
Getting locked out of root from all consoles is trivial and takes two steps in either order:
- Remove or lock the root password (a recommended configuration).
/etc/sudoers to an invalid configuration.
I always keep one or more root consoles open when making changes, and test with new connections before closing them.
Remote access is easier to break, and merely requires preventing access over protocols which permit logins. (Shorewall has/had an "absent minded admin" option to help prevent this.) Again, it helps to keep an active root console open while making changes. Tools with a test mode help as well, as you should regain access when the test times out and the configuration reverts.
If your password protocols work over the network (NIS, LDAP, etc), you can lock out all access by blocking their protocol(s) with iptables. If you have a cache working, you may not notice this immediately. Carefully test that the services are still working before logging out of your root console. Having a local account and/or password can help prevent this.
Password lockout policies can also cause problems. I have heard one developer describe how he locked himself out while implementing a password policy. His first policy was 1 failure and a 24 hour lockout. He was able to have someone else who was logged in to re-enable his account.