0

I have added a user test with root permissions. In my sshd_config file I have kept permitrootlogin as No, to block ssh for root. I am not able to do ssh for root which works fine, but the issue is i am not able to login test user also via ssh.

How can I fix this issue?

/etc/passwd extracts:

root:x:0:0:root:/root:/bin/sh

test:x:0:0::/home/test:/usr/sbin/myshell
  • Is there a password hash in /etc/shadow for user test? Also, what error message do you get? – Panki Aug 26 '19 at 10:44
  • yes the shadow file hashes are different for root and test .I am not able login to test user via ssh.the error shows related to authentication failures – bhupathi sumanth Aug 26 '19 at 10:46
  • 2
    Just set PermitRootLogin to without-password instead of no and use public key auth to login as root. Or just set a strong password. What are you supposed to achive by creating a test alias for root? – mosvy Aug 26 '19 at 12:39
  • I'm not even sure how well supported multiple passwd entries with the same uid are. The userdel(1) from the shadow package will refuse the delete your test user. Having getpwuid(pw->pw_uid) return a different entry than pw is certainly very confusing. – mosvy Aug 26 '19 at 12:50
  • Thank u moosy for suggestions will try with that without-password option.For test user we wanted to use some functionality which can done by root ,but unfortunately sudo ,su are absent in our linux customer build .so we have gone for setting the options for test as root with uid 0 – bhupathi sumanth Aug 26 '19 at 13:53
2

You can resolve this issue by creating a normal user for login, and then using a local escalation tool (su, sudo, doas, pkexec...) to gain root privilege.

OpenSSH (like many other tools) does not restrict root based on the string "root", but rather on the privileged UID zero. Since you have set the UID of your new user to zero, it will fail to login in exactly those situations where root cannot login.

For one example, from userauth_finish() in auth2.c in the OpenSSH source:

    /* Special handling for root */
    if (authenticated && authctxt->pw->pw_uid == 0 &&
        !auth_root_allowed(ssh, method))
            authenticated = 0;
  • Thanks for your info,but unfortanely in our linux board sudo support is not there.i have edited the sshd_config to support test user by adding the following lines PermitRootLogin "yes" DenyUsers "root".can we do like this?It is working for me? – bhupathi sumanth Aug 26 '19 at 12:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.