1

I've setup a machine on EC2 running Debian stretch. Upon trying to ssh as root, I get the following message:

$ ssh -i "mykey" root@machine
Please login as the user "admin" rather than the user "root".

^C
Connection to machine closed.

Note the ^C - the command doesn't terminate.

I can login as admin without a problem, and I'm aware of why this is done - I'm not sure about how, though.

My first hunch was the shell

admin@machine:~$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash

Nope. I checked nologin just in case:

admin@machine:~$ /usr/sbin/nologin  This account is currently not available.

Different message.

What is the mechanism that makes the system print out the message on login?

2 Answers 2

6
admin@machine:~$ sudo su 

root@machine:# cat /root/.ssh/authorized_keys 

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo
'Please login as the user \"admin\" rather than the user
\"root\".';echo;sleep 10" ssh-rsa ...

So that explains it. This is done through a custom command in the authorized_keys format - see the AUTHORIZED_KEYS FILE FORMAT section on the sshd manual for details.

As has been pointed out in comments, the reason for the sleep is likely so that PuTTY users have time to read the message

9
  • Why not using PermitRootLogin no in sshd_config? Commented Nov 25, 2018 at 17:04
  • 1
    My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work". Commented Nov 25, 2018 at 17:04
  • You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to the AUTHORIZED_KEYS FILE FORMAT section of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered... Commented Nov 25, 2018 at 17:28
  • @RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error Commented Nov 25, 2018 at 21:02
  • @UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason Commented Nov 25, 2018 at 21:03
-1

Below mentioned configuration will refuse root user to be logged in

vim /etc/ssh/sshd_config

PermitRootLogin no

AllowUsers [username]

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .