use pam_acccess only for /etc/pam.d/login

remove "Allow members of group 'ssh' to login."
remove "+:ssh:ALL EXCEPT LOCAL"

debian/security-misc.preinst

@@ -27,8 +27,8 @@ user_groups_modifications() {
    ## Useful to create groups in preinst rather than postinst.
    ## Otherwise if a user saw an error message such as this:
    ##
-   ## /var/lib/dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted.
-   ## /var/lib/dpkg/tmp.ci/preinst: ERROR: You probably want to run:
+   ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: No user is a member of group 'console'. Installation aborted.
+   ## /var/lib/ dpkg/tmp.ci/preinst: ERROR: You probably want to run:
    ## sudo adduser user console
    ##
    ## Then the user could not run 'sudo adduser user console' but also would
@@ -39,7 +39,6 @@ user_groups_modifications() {
    ## /etc/security/access-security-misc.conf
    addgroup --system console
    addgroup --system console-unrestricted
-   addgroup --system ssh
    ## This has no effect since by default this package also ships and an
    ## /etc/securetty configuration file that contains nothing but comments, i.e.
    ## an "empty" /etc/securetty.
@@ -132,54 +131,11 @@ console_users_check() {
    fi
 }
 
-ssh_users_check() {
-   if ! deb-systemd-helper --quiet was-enabled 'ssh.service'; then
-      return 0
-   fi
-
-   ssh_users="$(getent group ssh | cut -d: -f4)"
-   ## example ssh_users:
-   ## user
-
-   OLD_IFS="$IFS"
-   IFS=","
-   export IFS
-
-   for user_with_ssh in $ssh_users ; do
-      if [ "$user_with_ssh" = "root" ]; then
-         ## root login is also restricted.
-         ## Therefore user "root" being member of group "ssh" is
-         ## considered insufficient.
-         continue
-      fi
-      are_there_any_ssh_users=yes
-      break
-   done
-
-   IFS="$OLD_IFS"
-   export IFS
-
-   ## Prevent users from locking themselves out.
-   ## https://forums.whonix.org/t/is-security-misc-suitable-for-hardening-bridges-and-relays/8299/4
-   if [ ! "$are_there_any_ssh_users" = "yes" ]; then
-      echo "$0: ERROR: ssh.service is enabled but no user is a member of group 'ssh'." >&2
-      echo "$0: ERROR: Installation aborted since this would likely break SSH login." >&2
-      echo "$0: ERROR: You probably want to run:" >&2
-      echo "" >&2
-      echo "sudo adduser user ssh" >&2
-      echo "" >&2
-      echo "$0: ERROR: See also installation instructions:" >&2
-      echo "https://www.whonix.org/wiki/security-misc#install" >&2
-      exit 201
-   fi
-}
-
 user_groups_modifications
 
 if [ "$1" = "install" ] || [ "$1" = "upgrade" ]; then
    sudo_users_check
    console_users_check
-   ssh_users_check
 fi
 
 true "INFO: debhelper beginning here."

etc/security/access-security-misc.conf

@@ -20,9 +20,6 @@
 ## Qubes uses 'hvc0' when using in dom0 "sudo xl console vm-name".
 +:console:tty1 tty2 tty3 tty4 tty5 tty6 tty7 pts/0 pts/1 pts/2 pts/3 pts/4 pts/5 pts/6 pts/7 pts/8 pts/9 hvc0 hvc1 hvc2 hvc3 hvc4 hvc5 hvc6 hvc7 hvc8 hvc9
 
-## Allow members of group 'ssh' to login.
-+:ssh:ALL EXCEPT LOCAL
-
 ## Everyone else except members of group 'console-unrestricted'
 ## are restricted from everything else.
 -:ALL EXCEPT console-unrestricted :ALL

usr/lib/security-misc/pam_only_if_login

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+## Copyright (C) 2019 - 2019 ENCRYPTED SUPPORT LP <adrelanos@riseup.net>
+## See the file COPYING for copying conditions.
+
+## https://serverfault.com/questions/134471/success-n-control-syntax-in-pam-conf-pam-d-files
+
+set -x
+
+true "PAM_SERVICE: $PAM_SERVICE"
+
+if [ "$PAM_SERVICE" = "login" ]; then
+   ## FIXME:
+   ## Creates unwanted journal log entry.
+   ## pam_exec(login:account): /usr/lib/security-misc/pam_only_if_login failed: exit code 1
+   exit 1
+else
+   ## exit success so [success=1 default=ignore] will result in skipping the
+   ## next pam module.
+   exit 0
+fi

usr/share/pam-configs/console-lockdown-security-misc

@@ -1,6 +1,7 @@
-Name: allow only members of group console / ssh to login/incoming ssh (by package security-misc)
+Name: allow only members of group console to use login (by package security-misc)
 Default: no
 Priority: 280
 Account-Type: Primary
 Account:
+	[success=1 default=ignore]	pam_exec.so	seteuid quiet /usr/lib/security-misc/pam_only_if_login
 	required	pam_access.so accessfile=/etc/security/access-security-misc.conf debug