prevent ssh from login as root

[Rick Garland]

Hi all:

Got RedHat versions 7 and above.
Received info on pam/su stuff to prevent non-wheel group members from becoming root. Have setup the securetty file.

I also have ssh 3.5.1p1 installed on the Linux systems and on HPUX 11.00.

I am still able to ssh root@linux from the HP system. I need to stop this from happening. I want to block ssh root@linux and force the users to login as themselves 1st then become root (if a member of wheel).

How can I stop ssh root@linux?

Many thanks!

[Steven E. Protter]

My first thought would be to eliminate this direcotry:

$HOME/.ssh

Or just change the permissions to 000

Just do that on any box you want to stop ssh root logins in roots home directory.

I think at that point you will get authentication errors if you try and ssh as root.

If you exchange public keys between the machines, you can safely run ssh between boxes. I'm sure you have a reason for doing this, Secure Shell is safe for root. As far as I know anyway.

SEP

[Rick Garland]

Did some digging, found it.

In the /etc/ssh/sshd_config file is an entry for PermitRootLogin - set this value to no.

[Vincent Woo · Accepted solution]

change /etc/ssh/sshd_config

#PermitRootLogin yes (already comment out)

add this line
PermitRootLogin no