How to disable root login on console on debian and cent os 6. I have tried truncating /etc/securetty but it will disable all the users. I want to disable only root login through console.

  • Depends a bit on how you want to be able to login as root afterwards. Directly to the root account with SSH? Using a password or a key? Or do you just want to use su or sudo? – ilkkachu Mar 10 '17 at 12:46
  • 1
    Be careful - if all your non-root logins are not local to the machine (LDAP, for example), be sure that you still have some form of local login that would allow you to login to the machine no matter what. For example, if the only accounts you can log onto the machine directly are are LDAP-based accounts and the machine's network card fails, you might be unable to login at all if you don't have a purely local login available. – Andrew Henle Mar 10 '17 at 12:52

1) Activate the pam_access module on /etc/pam.d/login adding on the first 'account' line --> "account required pam_access.so" 2) Configure the access on /etc/security/access.conf : 3) +:root:cron crond [To avoid " pam_access(crond:account): access denied for user root' fromcron'" and "crontab: pam_access(crond:account): access denied for user root' fromcron'"] -:root:LOCAL


This will disable the root account on debian (not sure about cent os):

sudo passwd -l root
  • might as well add this answer (the accepted one) from serverfault with setting /bin/false as shell for root (it's an OS agnostic solution). Not the part about ssh. – hyph Mar 10 '17 at 12:44

You could also edit the /etc/passwd file. Change the /bin/bash at the end of the "root-line" to /bin/false or /usr/sbin/nologin.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.