1

I need to set PermitRootLogin no in Solaris 10 server, while still allowing two "peer" servers to have root access via ssh.

How can I achieve this?

Improve this question
0

2 Answers 2

Reset to default
5

Adding the below lines in the end of /etc/ssh/sshd_config is enough for this requirement:

Match Host unit1-priv0
   PermitRootLogin yes

Match Host unit0-priv0
   PermitRootLogin yes
Improve this answer
-1

Use public/private key.

It is described for many times in internet so I don't think it is userful to repeate it in detail again.

A briefly summary what to do:

  • enable root login on server
  • on client side create ssh public/private keys (ssh-keygen)
  • copy public key to server (ssh-copy-id root@your_server)
  • repeat for second client
  • disable root-login on server

Now only these two clients and the users of the commands above have root access to the server and additionally no password is required anymore.

Maybe this is an good entry point to start over (steps #1 and #2)

Improve this answer
7
  • 1
    This is actually really bad advice and does not answer the question. He clearly stated that he need to set PermitRootLogin no. And havig root enable with or without keys is still considered as not best practice.
    – BitsOfNix
    Jul 21, 2017 at 20:37
  • BitsOfNix: correct me if public/private key login is NOT possible while PermitRootLogin no is set. In this case my answer does not work. Otherwise the question clearly says that two peers still need root login via ssh, even if PermitRootLogin no is set. In this case this is an answer to the question and the use of keys is no bad advice/bad practice. I can't track your arguments/downvotes. And I would appreciate if you could justify please, why the use of keys is condideres as not best practice
    – ChristophS
    Jul 24, 2017 at 6:46
  • As an argument why to use keys: superuser.com/questions/303358/…
    – ChristophS
    Jul 24, 2017 at 7:31
  • read my comment again. the use of PermitRootLogin yes is a bad practice. While usage of keys is a best practice. OP needs to set PermitRootLogin no to disabllow any user from connecting with root, his scenario is only possible with match rule. Why is allowing remote login bad? See here: unix.stackexchange.com/questions/82626/…, here: howtogeek.com/howto/linux/…, But also CISSP guide clearly states that you can enable but so as multi-factor authentication.
    – BitsOfNix
    Jul 24, 2017 at 20:21
  • I agree, the use of PermitRootLogin yes is bad practice. So maybe this is a misunderstanding? My answer advises to disable root login in the end. It is only required once to install the public key. After all PermitRootLogin is set to no at all and only the two - by OP - required peers can login by using their private key. So my answer is exactly what you say. Would you read my answer once again please and we solve this gordian knot. ;)
    – ChristophS
    Jul 25, 2017 at 5:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .