security-misc/usr/share/pam-configs/console-lockdown-security-misc

Name: allow only members of group console to use login (by package security-misc)
Default: no
Priority: 280
Account-Type: Primary
Account:
	[success=1 default=ignore]	pam_exec.so	seteuid quiet /usr/libexec/security-misc/pam_only_if_login
	required	pam_access.so accessfile=/etc/security/access-security-misc.conf debug
use pam_acccess only for /etc/pam.d/login remove "Allow members of group 'ssh' to login." remove "+:ssh:ALL EXCEPT LOCAL" 2019-12-12 21:00:08 +07:00			`Name: allow only members of group console to use login (by package security-misc)`
Console Lockdown. Allow members of group 'console' to use tty1 to tty7. Everyone else except members of group 'console-unrestricted' are restricted from using console using ancient, unpopular login methods such as using /bin/login over networks, which might be exploitable. (CVE-2001-0797) Not enabled by default in this package since this package does not know which users shall be added to group 'console'. In new Whonix builds, user 'user" will be added to group 'console' and pam console-lockdown enabled by package anon-base-files. /usr/share/pam-configs/console-lockdown /etc/security/access-security-misc.conf https://forums.whonix.org/t/etc-security-hardening/8592 2019-12-07 17:40:20 +07:00			`Default: no`
			`Priority: 280`
			`Account-Type: Primary`
			`Account:`
move /usr/lib/security-misc to /usr/libexec/security-misc as per lintian FHS 2021-08-03 23:56:31 +07:00			`[success=1 default=ignore] pam_exec.so seteuid quiet /usr/libexec/security-misc/pam_only_if_login`
Console Lockdown. Allow members of group 'console' to use tty1 to tty7. Everyone else except members of group 'console-unrestricted' are restricted from using console using ancient, unpopular login methods such as using /bin/login over networks, which might be exploitable. (CVE-2001-0797) Not enabled by default in this package since this package does not know which users shall be added to group 'console'. In new Whonix builds, user 'user" will be added to group 'console' and pam console-lockdown enabled by package anon-base-files. /usr/share/pam-configs/console-lockdown /etc/security/access-security-misc.conf https://forums.whonix.org/t/etc-security-hardening/8592 2019-12-07 17:40:20 +07:00			`required pam_access.so accessfile=/etc/security/access-security-misc.conf debug`