0

I've setup a machine on EC2 running Debian stretch. Upon trying to ssh as root, I get the following message:

$ ssh -i "mykey" root@machine Please login as the user "admin" rather than the user "root".

^CConnection to machine closed.

Note the ^C - the command doesn't terminate.

I can login as admin without a problem, and I'm aware of why this is done - I'm not sure about how, though.

My first hunch was the shell

admin@machine:~$ grep root /etc/passwd root:x:0:0:root:/root:/bin/bash

Nope. I checked nologin just in case:

admin@machine:~$ /usr/sbin/nologin This account is currently not available.

Different message.

What is the mechanism that makes the system print out the message on login?

3

I figured it out, in the process of writing the question. I initially assumed that root had no ssh config, because bash didn't tab-complete. Of course, you cannot tab-complete if you don't have permissions to the files...

admin@machine:~$ sudo su

root@machine:# cat /root/.ssh/authorized_keys

no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"admin\" rather than the user \"root\".';echo;sleep 10" ssh-rsa ...

So that explains it. This is done through a custom command in the authorized_keys format - see the AUTHORIZED_KEYS FILE FORMAT section on the sshd manual for details.

As has been pointed out in comments, the reason for the sleep is likely so that PuTTY users have time to read the message

  • Why not using PermitRootLogin no in sshd_config? – Rui F Ribeiro Nov 25 '18 at 17:04
  • 1
    My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work". – Ulrich Schwarz Nov 25 '18 at 17:04
  • You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to the AUTHORIZED_KEYS FILE FORMAT section of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered... – RubberStamp Nov 25 '18 at 17:28
  • @RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error – goncalopp Nov 25 '18 at 21:02
  • @UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason – goncalopp Nov 25 '18 at 21:03
0

Below mentioned configuration will refuse root user to be logged in

vim /etc/ssh/sshd_config

PermitRootLogin no

AllowUsers [username]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.