Locking root access using SSH

[David Land]

Is there a file that I can create that blocks root access to the console when using SSH?

I already have the /etc/securetty file on my UNIX system, however, it seems to only block root direct login using telnet.

[Patrick Wallek · Accepted solution]

If you want to block root access via SSH overall, you should set

PermitRootLogin No

in your sshd_config file. The location of this file varies depending on your installation of SSH. This will disallow direct SSH to the server as the root user.

[David Land]

I found my sshd_config file and uncommented the PermitRootLogin option and added No to it. However, I can still logon as root using SSH.

Is there another reason why this is occuring?

[Patrick Wallek]

You need to stop and restart SSH.

[Walt Watson]

You may not want to do this, as the console is your 'salvation' should a problem occur with an ssh session and he root account. I recognize auditors may feel this makes the system safer, but it depends on how you use ssh and how secure your DC is. The console access has saved us many times.

[David Land]

How do you stop and restart SSH?

[Mel Burslan]

/sbin/init.d/secsh stop
/sbin/init.d/secsh start