2

The problem is that I really don't know if I am confused with PermitRootLogin or it is not working well. I put it in the sshd_config, and when I connect via ssh, I am able to do su - in order to have root permissions. So shouldn't PermitRootLogin no permit me that?

28

PermitRootLogin only configures whether root can login directly via ssh (e.g. ssh root@example.com). When you login using a different user account, whatever you do in your shell is not influenced by sshd's config.

From man sshd_config:

 PermitRootLogin
     Specifies whether root can log in using ssh(1).  The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”.  The default is “yes”.
     […]
     If this option is set to “no”, root is not allowed to log in.

You can however use your login.defs or pam config to limit which users can use the su command: Server Fault: Disable su on machine

3
  • So it doesn't means doing su -, it means login as root. But if I use allowUsers without allowing root, it is not needed the permitRootLogin?Thanks. Nov 6 '16 at 13:35
  • 8
    @QuicoLlinaresLlorens I would leave PermitRootLogin as "no" regardless as a secondary control measure. Nov 6 '16 at 17:51
  • I also would set the root default shell to /bin/false to have one more security layer. Nov 30 '16 at 11:31
-3

with PermitRootLogin yes, you can directly ssh as root.

ssh root@destination

If you want to disable sudo su for root access:

Lets says you have list of users(sudoers) that are allowed to do sudo on destination. This list is maintained at /etc/sudoers file.

1) Allow ssh for users that do not have sudo permissions in /etc/ssh/sshd. conf: AllowUsers sudoers

2) DenyUsers directive in /etc/ssh/sshd.conf: DenyUsers nonsudoers

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.