By default on RHEL 5.5 I have[deuberger@saleen trunk]$ sudo cat /etc/securetty consolevc/1vc/2vc/3vc/4vc/5vc/6vc/7vc/8vc/9vc/10vc/11tty1tty2tty3tty4tty5tty6tty7tty8tty9tty10tty11What is the difference between each of the entry types (console, vc/, and tty).  Specifically, what is the end result of adding and removing each entry type?My understanding is that they affect how and when you can login, but are there any other effects?  And when can you and when can you not login depending on which entries are there?EDIT 1What I do know is that tty 1-6 correspond to whether you can login from the first 6 consoles that you reach using CTRL-ALT-F1 through CTRL-ALT-F6.  I always thought those were virtual consoles, so I'm a bit confused.  And what does console correspond too?  Thanks.EDIT 2What is the effect if any in single user mode?
Effect of entries in /etc/securetty
linux;security;rhel;login;pam
/etc/securetty is consulted by pam_securetty module to decide from which virtual terminals (ttyS) root is allowed to login from.  In the past, /etc/securetty was consulted by programs like login directly, but now PAM handles that.  So changes to /etc/securetty will affect anything using PAM with a configuration file that uses pam_securetty.so.  So, only the login program is affected by default. /etc/pam.d/login is used for local logins and /etc/pam.d/remote is used for remote logins (like telnet).The primary entry types and their affects are as follows:If /etc/securetty doesn't exist, root is allowed to login from any ttyIf /etc/securetty exist and is empty, root access will be restricted to single user mode or programs that are not restricted by pam_securetty (i.e. su, sudo, ssh, scp, sftp)if you are using devfs (a deprecated filesystem for handling /dev), adding entries of the form vc/[0-9]* will permit root login from the given virtual console numberif you are using udev (for dynamic device management and replacement for devfs), adding entries of the form tty[0-9]* will permit root login from the given virtual console numberlisting console in securetty, normally has no effect since /dev/console points to the current console and is normally only used as the tty filename in single user mode, which is unaffected by /etc/securettyadding entries like pts/[0-9]* will allow programs that use pseudo-terminals (pty) and pam_securetty to login into root assuming the allocated pty is one of the ones listed; it's normally a good idea not to include these entries because it's a security risk; it would allow, for instance, someone to login into root via telenet, which sends passwords in plaintext (note that pts/[0-9]* is the format for udev which is used in RHEL 5.5; it will be different if using devfs or some other form of device management)For single user mode, /etc/securetty is not consulted because the sulogin is used instead of login.  See the sulogin man page for more info.  Also you can change the login program used in /etc/inittab for each runlevel.Note that to you should not use /etc/securetty to control root logins via ssh.  To do that change the value of PermitRootLogin in /etc/ssh/sshd_config.  By default /etc/pam.d/sshd is not configured to consult pam_securetty (and therefore /etc/securetty).  You could add a line to do so, but ssh doesn't set the actual tty until sometime after the auth stage, so it doesn't work as expected.  During the auth and account stages – at least for openssh – the tty (PAM_TTY) is hardcoded to ssh.The above answer is based on RHEL 5.5.  Much of it will pertain to current distributions of other *nix systems, but there are differences, some of which I noted, but not all.I answered this myself because the other answers were incomplete and/or inaccurate. Many other forums, blogs, etc online have inaccurate and incomplete information in this topic as well, so I've done extensive research and testing to try to get the correct details. If anything I've said is wrong, please let me know though.Sources:http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/Deployment_Guide/ch-sec-network.html#s1-wstation-privilegeshttp://www.mathematik.uni-marburg.de/local-doc/centos5/pam-0.99.6.2/html/sag-pam_securetty.htmlhttp://linux.die.net/man/1/loginhttp://www.tldp.org/HOWTO/html_single/Text-Terminal-HOWTO/http://www.kernel.org/doc/Documentation/devices.txthttp://en.wikipedia.org/wiki/Virtual_consolehttp://en.wikipedia.org/wiki/Linux_consolehttp://www.kernel.org/doc/man-pages/online/pages/man4/console.4.htmlhttp://www.unix.com/security/8527-restricting-root-login.htmlhttp://www.redhat.com/mirrors/LDP/HOWTO/Serial-HOWTO-11.html#ss11.3http://www.mathematik.uni-marburg.de/local-doc/centos5/udev-095/udev_vs_devfs