#+:root:ALL

# Deny root logins via the network:
-:root:ALL EXCEPT LOCAL

+:admin:ALL
-:ALL:ALL