2

I am trying to disable root login. I set PermitRootLogin no in /etc/ssh/sshd_config.

When I run ssh root@IP, I get Permission denied, please try again. which is correct.

When I login into root using su - command from another user, I still see XXXXX number of failed login attempts.

Is this normal or did I forgot about something?

I am running CentOS 7.

  • I don't understand the problem. You have disabled root logins and you have no successful login attempts. Everything looks right. Why do you think something is wrong? – Gilles Feb 21 '17 at 23:46
  • nono, when I use su - to login to root rom another user I see a wast amount of failed login attempts. – sanjihan Feb 21 '17 at 23:51
  • So? You're probably hit by automatic scans. – Gilles Feb 22 '17 at 0:04
2

Is this normal or did I forgot about something? I am running centos 7.

Yes, it is normal and expected behavior. Failed attempts are always logged and if the root is not allowed to login, every attempt though ssh fails.

0

You can disable the root account with sudo passwd -l root. Editing the sshd_config file affects ssh logins only. This disables su - as well since the password is not known by anyone.

from man passwd:

-l, --lock Lock the password of the named account. This option disables a password by changing it to a value which matches no possible encrypted value (it adds a ´!´ at the beginning of the password).

Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod --expiredate 1 (this set the account's expire date to Jan 2, 1970).

Users with a locked password are not allowed to change their password.

  • Thanks, but the main goal was to disable ssh root login, since that is what attackers are doing. To my best understanding, ssh root login is disabled in my case? – sanjihan Feb 21 '17 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.