Disabling root login via Secure Shell

[Andrew Kaplan]

Hi there --

What configuration file(s) and what syntax should I use to modify in order to prevent the root user from being able to log into a system via SSH? Thanks

[Mel Burslan]

logged in as root, create a file under /etc, called securetty and insert one line in it whic says console and you are done

as root, run these two commands:

echo console >/etc/securetty
chmod 600 /etc/securetty

[Patrick Wallek]

In your sshd_config a line like this:

PermitRootLogin no

will disallow root logins via SSH. The location of the file may vary depending on where you got your SSH from.

I am using the HP distributed SSH and this file is located in /etc/opt/ssh.

You will have to stop and restart SSH for this to take effect.

[Patrick Wallek]

/etc/securetty has no effect on SSH. At least not for me.

[Jaime Bolanos Rojas.]

Andrew,

To prevent root from logging in via ssh modify the sshd.config file and look for the PermitRootLogin line, you want to change this parameter to no.

The location of the file is in /opt/ssh/etc, at the end please restart the service.

Regards,

Jaime.

[Andrew Kaplan]

Thanks for the help. I modified the sshd_config file and restarted secure shell. As long as I am asking, I would like to have the "Authorized Use" or "Unwelcome Mat" message appear when a user logs into the system by ssh. Again, what file(s) would I need to accomplish this? Thanks.

[Mark Fenton]

again, in the sshd_config file, uncomment the line
#Banner /some/path

and replace /some/path with whatever the path to the banner message you want displayed.

Restart sshd and you've got it.

[Amitava_HP-UX]

Hi
The thread is quite informative but i want to dissable root login using password over ssh. I want ssh root login using public key authentication to be remain open. How to do that
I have lots of scripts which calls programmes from one server to other using public key login. I cant stop those.
Pls help.

[Matti_Kurkela]

The PermitRootLogin option can be given four values. The default is "yes"; the obvious alternative "no" was already mentioned. The other values are "without-password" and "forced-commands-only".
Please read "man sshd_config" for more information.

The "without-password" does NOT mean root can login with no authentication at all: it means that root can use any authentication mechanism other than a password to log in. Usually this means SSH keys, but in some environments this could also mean smart card, SecurID or some other authentication system.

The "forced-commands-only" is a very strict setting: it accepts SSH keys only, *and* each authorized key must have a fixed command defined for it in the root user's ~/.ssh/authorized_keys file. When a root login is made using a key, sshd does not even check what the client wanted: it runs the command specified for that key, and nothing else. When that command completes, the connection is closed.

The "forced-commands-only" option might be useful if someone steals the keys you're using for automated actions with root access. In the normal situation, the thief can do *anything* to your systems; but if you're using forced commands, the damage is limited. For example, if someone steals the key used to make backups, you know the thief can steal your data (by making an "extra backup") but he/she cannot corrupt the data in your system.

[yulianto piyut]

hi,

find your configuration for ssh config. for default, sshd_config put in /opt/ssh/etc
edit line:
PermitRootlogin No

than restart your sshd daemon:
#ps -ef|grep sshd
#kill -HUP pid of sshd


-yut-