topic Locking root access using SSH in Operating System - HP-UX

Locking root access using SSH

David Land — Wed, 09 Sep 2009 19:48:56 GMT

Is there a file that I can create that blocks root access to the console when using SSH?

I already have the /etc/securetty file on my UNIX system, however, it seems to only block root direct login using telnet.

Re: Locking root access using SSH

Patrick Wallek — Wed, 09 Sep 2009 19:53:22 GMT

If you want to block root access via SSH overall, you should set

PermitRootLogin No

in your sshd_config file. The location of this file varies depending on your installation of SSH. This will disallow direct SSH to the server as the root user.

Re: Locking root access using SSH

David Land — Wed, 09 Sep 2009 20:20:01 GMT

I found my sshd_config file and uncommented the PermitRootLogin option and added No to it. However, I can still logon as root using SSH.

Is there another reason why this is occuring?

Re: Locking root access using SSH

Patrick Wallek — Wed, 09 Sep 2009 20:27:21 GMT

You need to stop and restart SSH.

Re: Locking root access using SSH

Walt Watson — Wed, 09 Sep 2009 22:42:44 GMT

You may not want to do this, as the console is your 'salvation' should a problem occur with an ssh session and he root account. I recognize auditors may feel this makes the system safer, but it depends on how you use ssh and how secure your DC is. The console access has saved us many times.

Re: Locking root access using SSH

David Land — Thu, 10 Sep 2009 12:41:04 GMT

How do you stop and restart SSH?

Re: Locking root access using SSH

Mel Burslan — Thu, 10 Sep 2009 12:46:32 GMT

/sbin/init.d/secsh stop
/sbin/init.d/secsh start