Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

After I found out hundreds of hacking attempts are made in a day I decided I want to disable logging in to root remotely via a password. But then I found I can't switch users in WinSCP so I can't easily upload/download/edit files.

After I figured out how to disable remote logins it appeared I can't login remotely via a key. So I allowed it and disabled the password. But it turns out it disables passwords on all users.

How do you recommend protecting myself when logging in to my server? Someone mentioned he uses one time login tokens, but I am unsure how to use that.

But anyways, how do I disable password login for root but allow it for everyone else? I must be able to su into root from the other accounts bc primary I log into acidzombie24 then su to root and carry on normally.

share|improve this question
add comment

2 Answers 2

to disable the root password, you need to lock the root account:

sudo passwd -l root
sudo chage -E-1 root

explanation:

the first line locks the root a/c, but also expires the password, meaning stuff might break (like the root crontab, for example!!). The second line sets the root password to "never expire", so that this doesn't happen, and so that you can still use sudo su for example.

Combine this with PermitRootLogin No in /etc/ssh/sshd_config, and you should be good to go.

share|improve this answer
add comment

I am not sure at the time of writing this about making su work, but see this article from IBM Developerworks for good information on securing SSH.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.