Root login access is controlled by a file called /etc/default/login. This file is
read by login before it runs and various variables are pulled from it.
One of these is "CONSOLE=". If it has a value, then that is the *only* device
root logins are accepted on. The default value the system is shipped with is
CONSOLE=/dev/console. Note that this is for *any* login whose uid is 0 - not
just logins called 'root'. There is no provision for multiple console devices.
Other values that login will read:
ALTSHELL=
If set to YES will place SHELL="value from passwd entry for shell" in the
environment - assuming the entry is non-null. If the entry is null,
login will use /sbin/sh or /usr/bin/sh (if /sbin/sh is not executable)
and not place the SHELL= environment variable. Default value in
login default value is YES.
PASSREQ=
Indicates if all users must have a password. Default is YES (based on value
in login default file). If no entry in login default file, passwords are
not required.
TIMEZONE=
Value used for timezone *if* the file /etc/TIMEZONE does not have a value.
If that file exists and has a value, the value in the login default file
is not used. If neither have values, the file /usr/lib/locale/TZ/localtime
is used. Default value is none.
HZ=
Value of the HZ environment variable. Default is 100 (for desktop systems) -
set in login default file.
PATH=
If login uid is not 0, the default path provided. Default: /usr/bin
SUPATH=
If login uid is 0, the default path provided. Default:
/sbin:/usr/sbin:/usr/bin:/etc
ULIMIT=
Ulimit applied to all logins. Default is 0 (unlimited).
TIMEOUT=
Number of seconds before login gives up waiting for input. Default is 60.
Maximum is 900 (15 minutes).
UMASK=
Default value is 022 which will be applied if a faulty umask is provided
or none is specified.
IDLEWEEKS=
Number of weeks password can be expired before logins are denied.
Default is no value (i.e., not checked). If set to zero, all expired
passwords (no matter how long expired) will require root intervention
to restore access.
Changes to this file will be seen the next time a login is attempted. Access should
be restricted to root (for writing). The security paranoid could make a case for
blocking read access to others also.
Additional note: if the file /var/adm/loginlog is present, failed login attempts
will be logged in that file after the fifth consecutive failure.