0

I have added a user test with root permissions. In my sshd_config file I have kept permitrootlogin as No, to block ssh for root. I am not able to do ssh for root which works fine, but the issue is i am not able to login test user also via ssh.

How can I fix this issue?

/etc/passwd extracts:

root:x:0:0:root:/root:/bin/sh

test:x:0:0::/home/test:/usr/sbin/myshell
7
  • Is there a password hash in /etc/shadow for user test? Also, what error message do you get?
    – Panki
    Commented Aug 26, 2019 at 10:44
  • yes the shadow file hashes are different for root and test .I am not able login to test user via ssh.the error shows related to authentication failures Commented Aug 26, 2019 at 10:46
  • 2
    Just set PermitRootLogin to without-password instead of no and use public key auth to login as root. Or just set a strong password. What are you supposed to achive by creating a test alias for root?
    – user313992
    Commented Aug 26, 2019 at 12:39
  • I'm not even sure how well supported multiple passwd entries with the same uid are. The userdel(1) from the shadow package will refuse the delete your test user. Having getpwuid(pw->pw_uid) return a different entry than pw is certainly very confusing.
    – user313992
    Commented Aug 26, 2019 at 12:50
  • Thank u moosy for suggestions will try with that without-password option.For test user we wanted to use some functionality which can done by root ,but unfortunately sudo ,su are absent in our linux customer build .so we have gone for setting the options for test as root with uid 0 Commented Aug 26, 2019 at 13:53

1 Answer 1

2

You can resolve this issue by creating a normal user for login, and then using a local escalation tool (su, sudo, doas, pkexec...) to gain root privilege.

OpenSSH (like many other tools) does not restrict root based on the string "root", but rather on the privileged UID zero. Since you have set the UID of your new user to zero, it will fail to login in exactly those situations where root cannot login.

For one example, from userauth_finish() in auth2.c in the OpenSSH source:

    /* Special handling for root */
    if (authenticated && authctxt->pw->pw_uid == 0 &&
        !auth_root_allowed(ssh, method))
            authenticated = 0;
1
  • Thanks for your info,but unfortanely in our linux board sudo support is not there.i have edited the sshd_config to support test user by adding the following lines PermitRootLogin "yes" DenyUsers "root".can we do like this?It is working for me? Commented Aug 26, 2019 at 12:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .