4

The problem is that I really don't know if I am confused with PermitRootLogin or it is not working well. I put it in the sshd_config, and when I connect via ssh, I am able to do su - in order to have root permissions. So shouldn't PermitRootLogin no permit me that?

2 Answers 2

30

PermitRootLogin only configures whether root can login directly via ssh (e.g. ssh [email protected]). When you login using a different user account, whatever you do in your shell is not influenced by sshd's config.

From man sshd_config:

 PermitRootLogin
     Specifies whether root can log in using ssh(1).  The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”.  The default is “yes”.
     […]
     If this option is set to “no”, root is not allowed to log in.

You can however use your login.defs or pam config to limit which users can use the su command: Server Fault: Disable su on machine

3
  • So it doesn't means doing su -, it means login as root. But if I use allowUsers without allowing root, it is not needed the permitRootLogin?Thanks. Nov 6, 2016 at 13:35
  • 9
    @QuicoLlinaresLlorens I would leave PermitRootLogin as "no" regardless as a secondary control measure. Nov 6, 2016 at 17:51
  • I also would set the root default shell to /bin/false to have one more security layer. Nov 30, 2016 at 11:31
-3

with PermitRootLogin yes, you can directly ssh as root.

ssh root@destination

If you want to disable sudo su for root access:

Lets says you have list of users(sudoers) that are allowed to do sudo on destination. This list is maintained at /etc/sudoers file.

1) Allow ssh for users that do not have sudo permissions in /etc/ssh/sshd. conf: AllowUsers sudoers

2) DenyUsers directive in /etc/ssh/sshd.conf: DenyUsers nonsudoers

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .