Container-Optimized OS
TMA-COS-5.4
Ensure root login is restricted to system console
HighLevel 1Manual reviewcos
Description
The file /etc/securetty contains a list of valid terminals that may be logged in directly as root. Since the system console has special properties to handle emergency situations, it is important to ensure that the console is in a physically secure location and that unauthorized consoles have not been defined.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
# cat /etc/securetty
How it is fixed
Fix method: Guidance or infrastructure patch
Remove entries for any consoles that are not in a physically secure location.
Properties
- Operating systems
- Any
- Tags
- container-optimized-oscoslogging
- Reference
- CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.4 Ensure root login is restricted to system console