The problem is that I really don't know if I am confused with PermitRootLogin or it is not working well.
I put it in the sshd_config, and when I connect via ssh, I am able to do
su - in order to have root permissions. So shouldn't
PermitRootLogin no permit me that?
PermitRootLogin only configures whether root can login directly via ssh (e.g.
ssh email@example.com). When you login using a different user account, whatever you do in your shell is not influenced by
PermitRootLogin Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”. The default is “yes”. […] If this option is set to “no”, root is not allowed to log in.
You can however use your
pam config to limit which users can use the
su command: Server Fault: Disable su on machine
with PermitRootLogin yes, you can directly ssh as root.
If you want to disable sudo su for root access:
Lets says you have list of users(sudoers) that are allowed to do sudo on destination. This list is maintained at /etc/sudoers file.
1) Allow ssh for users that do not have sudo permissions in /etc/ssh/sshd. conf: AllowUsers sudoers
2) DenyUsers directive in /etc/ssh/sshd.conf: DenyUsers nonsudoers