documentation_complete: true

title: 'Direct root Logins Not Allowed'

description: |-
    To further limit access to the <tt>root</tt> account, administrators can disable root logins at the console by editing the <tt>/etc/securetty</tt> file.
    This file lists all devices the root user is allowed to login to.
    If the file does not exist at all, the root user can login through any communication device on the system, whether via the console or via a raw network interface.
    This is dangerous as user can login to his machine as root via Telnet, which sends the password in plain text over the network.
    By default, WRLinux's <tt>/etc/securetty</tt> file only allows the root user to login at the console physically attached to the machine.
    To prevent root from logging in, remove the contents of this file.
    To prevent direct root logins, remove the contents of this file by typing the following command:
    <pre>echo &gt; /etc/securetty</pre>

rationale: |-
    Disabling direct root logins ensures proper accountability and multifactor authentication to privileged accounts.
    Users will first login, then escalate to privileged (root) access via su / sudo.
    This scenario is nowadays required by security standards.

severity: medium

references:
    nist: IA-2(1)

ocil_clause: 'the /etc/securetty file is not empty'

ocil: |-
    To ensure root may not directly login to the system over physical consoles, run the following command:
    <pre>cat /etc/securetty</pre>
    If any output is returned, this is a finding.
