/etc/securetty is consulted by
pam_securetty module to decide from which virtual terminals (
root is allowed to login from.
In the past,
/etc/securetty was consulted by programs like
login directly, but now PAM handles that. So changes to
/etc/securetty will affect anything using PAM with a configuration file that uses
pam_securetty.so. So, only the
login program is affected by default.
/etc/pam.d/login is used for local logins and
/etc/pam.d/remote is used for remote logins (like telnet).
The primary entry types and their affects are as follows:
/etc/securetty doesn't exist,
root is allowed to login from any
/etc/securetty exist and is empty,
root access will be restricted to single user mode or programs that are not restricted by
- If you are using
devfs (a deprecated filesystem for handling
/dev), adding entries of the form
vc/[0-9]* will permit root login from the given virtual console number.
- If you are using
udev (for dynamic device management and replacement for
devfs), adding entries of the form
tty[0-9]* will permit root login from the given virtual console number.
/etc/securetty normally has no effect since
/dev/console points to the current console and is normally only used as the
tty filename in single user mode, which is unaffected by
- Adding entries like
pts/[0-9]* will allow programs that use pseudo-terminals (
pam_securetty to login into
root assuming the allocated
pty is one of the ones listed; it's normally a good idea not to include these entries because it's a security risk; it would allow, for instance, someone to login into root via telnet, which sends passwords in plaintext (note that
pts/[0-9]* is the format for
udev which is used in RHEL 5.5; it will be different if using
devfs or some other form of device management).
For single user mode,
/etc/securetty is not consulted because the
sulogin is used instead of
login (see the
sulogin man page for more info). Also you can change the login program used in
/etc/inittab for each runlevel.
Note that to you should not use
/etc/securetty to control
root logins via
ssh. To do that change the value of
/etc/ssh/sshd_config. By default
/etc/pam.d/sshd is not configured to consult
pam_securetty (and therefore
/etc/securetty). You could add a line to do so, but
ssh doesn't set the actual
tty until sometime after the
auth stage, so it doesn't work as expected. During the
account stages - at least for
openssh - the
PAM_TTY) is hardcoded to
The above answer is based on RHEL 5.5. Much of it will pertain to current distributions of other *nix systems, but there are differences, some of which I noted, but not all.
I answered this myself because the other answers were incomplete and/or inaccurate. Many other forums, blogs, etc online have inaccurate and incomplete information in this topic as well, so I've done extensive research and testing to try to get the correct details. If anything I've said is wrong, please let me know though.