topic Disabling root login via Secure Shell in Operating System - HP-UX

Disabling root login via Secure Shell

Andrew Kaplan — Fri, 14 Jul 2006 15:35:27 GMT

Hi there --

What configuration file(s) and what syntax should I use to modify in order to prevent the root user from being able to log into a system via SSH? Thanks

Re: Disabling root login via Secure Shell

Mel Burslan — Fri, 14 Jul 2006 15:40:59 GMT

logged in as root, create a file under /etc, called securetty and insert one line in it whic says console and you are done

as root, run these two commands:

echo console >/etc/securetty
chmod 600 /etc/securetty

Re: Disabling root login via Secure Shell

Patrick Wallek — Fri, 14 Jul 2006 15:42:51 GMT

In your sshd_config a line like this:

PermitRootLogin no

will disallow root logins via SSH. The location of the file may vary depending on where you got your SSH from.

I am using the HP distributed SSH and this file is located in /etc/opt/ssh.

You will have to stop and restart SSH for this to take effect.

Re: Disabling root login via Secure Shell

Patrick Wallek — Fri, 14 Jul 2006 15:44:05 GMT

/etc/securetty has no effect on SSH. At least not for me.

Re: Disabling root login via Secure Shell

Jaime Bolanos Rojas. — Fri, 14 Jul 2006 15:44:54 GMT

Andrew,

To prevent root from logging in via ssh modify the sshd.config file and look for the PermitRootLogin line, you want to change this parameter to no.

The location of the file is in /opt/ssh/etc, at the end please restart the service.

Regards,

Jaime.

Re: Disabling root login via Secure Shell

Andrew Kaplan — Fri, 14 Jul 2006 15:51:24 GMT

Thanks for the help. I modified the sshd_config file and restarted secure shell. As long as I am asking, I would like to have the "Authorized Use" or "Unwelcome Mat" message appear when a user logs into the system by ssh. Again, what file(s) would I need to accomplish this? Thanks.

Re: Disabling root login via Secure Shell

Mark Fenton — Fri, 14 Jul 2006 16:08:47 GMT

again, in the sshd_config file, uncomment the line
#Banner /some/path

and replace /some/path with whatever the path to the banner message you want displayed.

Restart sshd and you've got it.

Re: Disabling root login via Secure Shell

Amitava_HP-UX — Sun, 23 Jul 2006 01:14:10 GMT

Hi
The thread is quite informative but i want to dissable root login using password over ssh. I want ssh root login using public key authentication to be remain open. How to do that
I have lots of scripts which calls programmes from one server to other using public key login. I cant stop those.
Pls help.

Re: Disabling root login via Secure Shell

Matti_Kurkela — Sun, 23 Jul 2006 01:59:30 GMT

The PermitRootLogin option can be given four values. The default is "yes"; the obvious alternative "no" was already mentioned. The other values are "without-password" and "forced-commands-only".
Please read "man sshd_config" for more information.

The "without-password" does NOT mean root can login with no authentication at all: it means that root can use any authentication mechanism other than a password to log in. Usually this means SSH keys, but in some environments this could also mean smart card, SecurID or some other authentication system.

The "forced-commands-only" is a very strict setting: it accepts SSH keys only, *and* each authorized key must have a fixed command defined for it in the root user's ~/.ssh/authorized_keys file. When a root login is made using a key, sshd does not even check what the client wanted: it runs the command specified for that key, and nothing else. When that command completes, the connection is closed.

The "forced-commands-only" option might be useful if someone steals the keys you're using for automated actions with root access. In the normal situation, the thief can do *anything* to your systems; but if you're using forced commands, the damage is limited. For example, if someone steals the key used to make backups, you know the thief can steal your data (by making an "extra backup") but he/she cannot corrupt the data in your system.

Re: Disabling root login via Secure Shell

yulianto piyut — Sun, 23 Jul 2006 22:15:53 GMT

hi,

find your configuration for ssh config. for default, sshd_config put in /opt/ssh/etc
edit line:
PermitRootlogin No

than restart your sshd daemon:
#ps -ef|grep sshd
#kill -HUP pid of sshd

-yut-