- And here we go.
Last assignment.
Let's set up your system such that direct login
by the user route is only allowed on tty3.
And ensure this requires your root user to be able
to log in with a password.
So this last part is for Ubuntu users.
On Ubuntu, the root user cannot log in
because the user doesn't have a password.
So sudo passwd root, just like we would do
first on Ubuntu.
Then it's pam configuration.
So in
user/lib/security...
Oops, it is user/lib64/security.
We have these pams and the pam module
that we are looking for is securetty.so,
so pam_securetty.so.
And I wanna make sure that pam_securetty.so
is included in the pam login.
So I'm going to /etc/pam.d,
and there I'm editing the login file
to include pam_securetty.so in auth.
So that will be auth,
required, pam_securetty.so.
Now that we have that included, we need to create
a file with the name etc/securetty
and in etc/securetty, I'm listing tty3.
Really, it's nothing more than that.
And now we are going to test.
So first I'm using chvt for change virtual terminal.
I'm going to virtual terminal number 4.
To login as the root user,
and that doesn't seem to be working.
So let me get in as user student, that still works
and sudo -i
to open a root shell.
That still works because etc/securetty
just denies direct root user login.
Back to tty3,
logging in as root
with a password and that is working.
So from here, chvt 2.
And let's not forget to clean up the sessions.
Loginctl is how you can best do that.
So loginctl has this option, list-sessions
where we can see the sessions on tty4 and on tty3.
And that is what I want to terminate.
So loginctl terminate-session.
And in order to terminate we need the session numbers
which are session four and five.
So there we go.
Number four and number five.
And now if I use w,
which is also showing
currently logged in users,
we don't see these sessions anymore.
And let's also observe this from loginctl list-sessions.
We only have the student user now
on tty2 and that's what I wanted.
And this is how you integrate etc/securetty
to protect root logins from secure terminals only.