1

So, I've read that I shouldn't permit root logins by disabling them in my sshd_config. I understand how that might make a server safer, but if I have a user that is allowed to do "su root" and log into the server as root that way, what difference does it make? Seems like having a user that can log into the root user that way kinda defeats the purpose of the "PermitRootLogin" option.

  • PermitRootLogin No in the sshd_config, prevents someone to become root on another machine, because he or she has rights to do so and ssh'ing into your machine as root, even though their account doesn't have root privileges on the new machine. Yes it can be prevented by not allowing authorized key pairs to be stored etc, but sysadmins are absent minded sometimes and one temporary setting, forgotten to be removed can come back to bite you in the rear more often than one can imagine. So, having another layer of protection is not bad – MelBurslan Jan 26 '16 at 19:29
  • @MelBurslan why would the other computer be required? – drewbenn Jan 26 '16 at 19:36
  • Think about this. system1 can ssh into system2 as root and rootlogin is permitted in sshd_config. I have sudo privileges on system1 but not on system2 and think that it is for a good reason, like system1 being development and system2 being production. I can elevate my privileges on system1 and using the permitrootlogin backdoor, I can come to production system as root and try to fix a problem my code has caused, without leaving a trail. This is a big NO-NO by any type of auditing, SOX being the most widely known type. – MelBurslan Jan 26 '16 at 19:41
  • 1
    PermitRootLogin is not a back door; and sshd does not care (it doesn't even ask) what your username is on the system you're coming from, only the username you're requesting on its system. – drewbenn Jan 26 '16 at 19:45
  • Where does this multiple system idea come from? I'm running a single dedicated server. – Mercury Jan 26 '16 at 19:46
5

PermitRootLogin No doesn't prevent root logins entirely, it only prevents root logins through ssh. Enabling this option prevents a class of brute force attacks where an attacker tries to ssh root@server with some common passwords (including an empty password, which can work if PermitEmptyPasswords is enabled). The point of refusing remote root logins is that root is a very common username; by disabling remote root logins you require the attacker to also correctly guess a valid username.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.