Restrict root access

Patrick · July 8, 2019, 10:42pm

No root login → user only needs to remember and secure one password.

madaidan:

Uncommenting, auth required pam_wheel.so in /etc/pam.d/su will make it so only users in the root group can use su . This can prevent a compromised system user (e.g. the whonixcheck user) from switching to another user and/or gaining root. The user user can be added to the root group so they can use su normally or they can also be restricted and will have to use sudo .

Emptying the /etc/securetty file can prevent someone from logging in as root from a tty or console.

While not necessarily helpful for just the root account, we can increase the number of hashing rounds when hashing passwords by adding rounds=(number) to the end of the pam_unix.so module in /etc/pam.d/common-password. E.g. rounds=65536 . The higher the amount of rounds, the longer it takes to login and set passwords. 65536 rounds takes 1 second even on slow computers.

Thanks for elaborate explanation!

Could you implement this please?