I have an even more restrictive approach to grant root privileges on my server, which might be interesting for the paranoid ones like me.
Be careful what you do and in which order, otherwise you might end up with a system you can't get root access on.
- Create a specific group
sugroup, whos members will be allowed to become root and only allow key authentication for this group by putting the following lines at the end of sshd_confid:
Match Group sugroup
- Place the command
auth required pam_wheel.so group=sugroup in
/etc/pam.d/su. It might be already there and you just have to uncomment it. This denies root access to all users not member of sugroup
- Choose a strong root password :)
- Check whether your new authentication method works, and only if:
- Deny direct root login via ssh by using
PermitRootLogin no in
Using this configuration it is necessary to use a key authentication and a password to become root. I configured my server like this, since I prefer having no direct root access via ssh, regardless of the authentication method.