Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

For security purposes my company wants me to not allow anyone to be able to log into our Ubuntu server as root remotely over SSH. We still want the root account to exist, we just do not want it to be able to be logged into remotely. How would I accomplish this?

Thank you very much in advance for your time.

share|improve this question
    
would like to add create a sudoer entity so that you can still log in as non-root , and then after log in you can perform root activities, other wise you will not be able to use remote login like ssh to do any root permitted work check on man su man sudoers good luck –  BJ 52 Apr 8 at 3:56
add comment

3 Answers

up vote 22 down vote accepted

I assume you meant logging in over SSH? Put the following line to /etc/ssh/sshd_config:

PermitRootLogin no

If you want to deny certain users from logging in, put this in the configuration file:

DenyUsers root

This takes the blacklisting approach. Whitelisting is generally preferable. If your company needs to allow the rob and admin users log in on the server, use the following configuration directive:

AllowUsers rob admin

See also the manual page.

share|improve this answer
add comment

The default configuration is for the root account to be locked so you can not log in as root remotely. You don't have to do anything else, unless you also want to make sure that you can not log in as root remotely by using an RSA key. Of course, if you don't want to do that, then just don't set up a root key.

share|improve this answer
add comment

Edit the file /etc/ssh/sshd_config, look for

PermitRootLogin

and set it to no.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.