pam_securetty(8) [suse man page]
PAM_SECURETTY(8) Linux-PAM Manual PAM_SECURETTY(8) NAME
pam_securetty - Limit root login to special devices SYNOPSIS
pam_securetty.so [debug] DESCRIPTION
pam_securetty is a PAM module that allows root logins only if the user is logging in on a "secure" tty, as defined by the listing in /etc/securetty. pam_securetty also checks to make sure that /etc/securetty is a plain file and not world writable. This module has no effect on non-root users and requires that the application fills in the PAM_TTY item correctly. For canonical usage, should be listed as a required authentication method before any sufficient authentication methods. OPTIONS
debug Print debug information. MODULE TYPES PROVIDED
Only the auth module type is provided. RETURN VALUES
PAM_SUCCESS The user is allowed to continue authentication. Either the user is not root, or the root user is trying to log in on an acceptable device. PAM_AUTH_ERR Authentication is rejected. Either root is attempting to log in via an unacceptable device, or the /etc/securetty file is world writable or not a normal file. PAM_INCOMPLETE An application error occurred. pam_securetty was not able to get information it required from the application that called it. PAM_SERVICE_ERR An error occurred while the module was determining the user's name or tty, or the module could not open /etc/securetty. PAM_USER_UNKNOWN The module could not find the user name in the /etc/passwd file to verify whether the user had a UID of 0. Therefore, the results of running this module are ignored. EXAMPLES
auth required pam_securetty.so auth required pam_unix.so SEE ALSO
securetty(5), pam.conf(5), pam.d(5), pam(8) AUTHOR
pam_securetty was written by Elliot Lee <sopwith@cuc.edu>. Linux-PAM Manual 04/01/2010 PAM_SECURETTY(8)
Check Out this Related Man Page
PAM_WHEEL(8) Linux-PAM Manual PAM_WHEEL(8) NAME
pam_wheel - Only permit root access to members of group wheel SYNOPSIS
pam_wheel.so [debug] [deny] [group=name] [root_only] [trust] DESCRIPTION
The pam_wheel PAM module is used to enforce the so-called wheel group. By default it permits root access to the system if the applicant user is a member of the wheel group. If no group with this name exist, the module is using the group with the group-ID 0. OPTIONS
debug Print debug information. deny Reverse the sense of the auth operation: if the user is trying to get UID 0 access and is a member of the wheel group (or the group of the group option), deny access. Conversely, if the user is not in the group, return PAM_IGNORE (unless trust was also specified, in which case we return PAM_SUCCESS). group=name Instead of checking the wheel or GID 0 groups, use the name group to perform the authentication. root_only The check for wheel membership is done only. trust The pam_wheel module will return PAM_SUCCESS instead of PAM_IGNORE if the user is a member of the wheel group (thus with a little play stacking the modules the wheel members may be able to su to root without being prompted for a passwd). MODULE TYPES PROVIDED
The auth and account module types are provided. RETURN VALUES
PAM_AUTH_ERR Authentication failure. PAM_BUF_ERR Memory buffer error. PAM_IGNORE The return value should be ignored by PAM dispatch. PAM_PERM_DENY Permission denied. PAM_SERVICE_ERR Cannot determine the user name. PAM_SUCCESS Success. PAM_USER_UNKNOWN User not known. EXAMPLES
The root account gains access by default (rootok), only wheel members can become root (wheel) but Unix authenticate non-root applicants. su auth sufficient pam_rootok.so su auth required pam_wheel.so su auth required pam_unix.so SEE ALSO
pam.conf(5), pam.d(5), pam(7) AUTHOR
pam_wheel was written by Cristian Gafton <gafton@redhat.com>. Linux-PAM Manual 05/31/2011 PAM_WHEEL(8)