PAM_SECURETTY(8)

📦
version 1.7.3 · 19 versions
, in arch rolling

✨ PAM_SECURETTY ✨

okay bestie, gather round, because this one is literally about keeping root out of places it shouldn't be 💅 it lives in the Linux-PAM Manual and it's giving "bouncer at the club door, but for ttys".

🌸 NAME 🌸

pam_securetty — limit root login to special devices 🎀

🦋 SYNOPSIS 🦋

pam_securetty.so [debug]

💖 DESCRIPTION 💖

so pam_securetty is a PAM module that lets root log in only if the user is logging in on a "secure" tty, and "secure" is defined by the listing in the securetty file. no cap, that's the whole vibe check 👑

first thing it does, pam_securetty checks whether /etc/securetty exists. if it doesn't, and it was built with vendordir support, it will use /securetty instead. ✨

pam_securetty also checks that the securetty files are plain files and not world writable — because a world-writable securetty is a whole mess and we are not doing that 🚫

it will also allow root logins on the tty specified with the console= switch on the kernel command line, and on ttys from /sys/class/tty/console/active. iconic of it honestly.

this module has no effect on non-root users, and it requires that the application fills in the PAM_TTY item correctly. like, if the app doesn't hand over the tty properly, this whole thing is a no-op, so... do that 🫶

for canonical usage, it should be listed as a required authentication method before any sufficient authentication methods. order matters, bestie, it's not a suggestion 🎀

⭐ OPTIONS ⭐

  • debug — print debug information. the receipts, the lore, all of it 🔍
  • noconsole — do not automatically allow root logins on the kernel console device, as specified on the kernel command line or by the sys file, if it is not also specified in the securetty file. so basically: if you want console logins to have to earn it by being in the securetty file, flip this on 💅

🌈 MODULE TYPES PROVIDED 🌈

only the auth module type is provided. that's it. that's the list. one and done 👑

💜 RETURN VALUES 💜

  • PAM_SUCCESS — the user is allowed to continue authentication. either the user is not root, or the root user is trying to log in on an acceptable device. slay, we move 🎉
  • PAM_AUTH_ERR — authentication is rejected. either root is attempting to log in via an unacceptable device, or the securetty file is world writable or not a normal file. 🚫
  • PAM_BUF_ERR — memory buffer error. the vibes ran out of RAM, basically 😭
  • PAM_CONV_ERR — the conversation method supplied by the application failed to obtain the username. app fumbled the intro 🙈
  • PAM_INCOMPLETE — the conversation method supplied by the application returned PAM_CONV_AGAIN. it said "brb" 💀
  • PAM_SERVICE_ERR — an error occurred while the module was determining the user's name or tty, or the module could not open the securetty file. something broke mid-detective-work 🔥
  • PAM_USER_UNKNOWN — the module could not find the user name in the /etc/passwd file to verify whether the user had a UID of 0. therefore, the results of running this module are ignored. like, the module just shrugs and walks away 🤷♀️

🎀 EXAMPLES 🎀

the canonical setup, copy it exactly bestie:

auth  required  pam_securetty.so
auth  required  pam_unix.so

see how pam_securetty.so comes first? that's the "required before any sufficient" thing we talked about. ate. 💅

🔥 SEE ALSO 🔥

securetty(5), pam.conf(5), pam.d(5), pam(8)

👑 AUTHOR 👑

pam_securetty was written by Elliot Lee <sopwith@cuc.edu>. ty for your service king 🫶

okay that's the whole page, bestie!! go forth and secure those ttys 🌸🦋 this was the Linux-PAM manual, dated 09/27/2026, and the page you just read is PAM_SECURETTY(8). mwah 💖✨🎀

📦 where this page comes from