search

pyllyukko / harden.yml

Ansible playbook for Linux hardening
MIT License
75 stars 9 forks source link

securetty in Debian #47

Closed pyllyukko closed 3 years ago

pyllyukko commented 5 years ago

FWIW, the latest login upload to unstable (1:4.7-1) dropped support for /etc/securetty and removed that file on upgrades, due to the numerous complaints it caused:

,---- shadow (1:4.7-1) unstable; urgency=medium
[ Balint Reczey ]
* Stop shipping and honoring /etc/securetty
(Closes: #731656, #830255, #879903, #920764, #771675, #917893, #607073)

`----

This lead to complaints by pam_unix in the system logs on every login, see #931899. I think it's time to disable pam_securetty by default, it was useful twenty years ago but it no longer is.

pyllyukko commented 3 years ago

If distros don't use securetty it shouldn't still matter if the configuration exists. Also to play it safe we should have this conditionally and inspect PAM's configuration for pam_securetty which would introduce unnecessary complexity.