So, I've read that I shouldn't permit root logins by disabling them in my sshd_config. I understand how that might make a server safer, but if I have a user that is allowed to do "su root" and log into the server as root that way, what difference does it make? Seems like having a user that can log into the root user that way kinda defeats the purpose of the "PermitRootLogin" option.
1 Answer
PermitRootLogin No doesn't prevent root logins entirely, it only prevents root logins through ssh. Enabling this option prevents a class of brute force attacks where an attacker tries to ssh root@server with some common passwords (including an empty password, which can work if PermitEmptyPasswords is enabled). The point of refusing remote root logins is that root is a very common username; by disabling remote root logins you require the attacker to also correctly guess a valid username.
PermitRootLogin Noin the sshd_config, prevents someone to become root on another machine, because he or she has rights to do so and ssh'ing into your machine as root, even though their account doesn't have root privileges on the new machine. Yes it can be prevented by not allowing authorized key pairs to be stored etc, but sysadmins are absent minded sometimes and one temporary setting, forgotten to be removed can come back to bite you in the rear more often than one can imagine. So, having another layer of protection is not bad