3

I am new to Linux/Ubuntu and I have a Ubuntu instance in GCP and want to restrict the root access from the outside like ssh and putty, but however I want to access root by using the command su root . Is there any way to achieve that it will good for security.

I tried PermitRootLogin no in /etc/ssh/ssh_config but it didn't work. I can still access root using putty.

Thanks.

4
  • Hello. Did you restart the ssh service after the configuration change - sudo systemctl restart sshd? Which version is your Ubuntu?
    – pa4080
    Sep 26, 2019 at 7:50
  • yes i did, version Ubuntu 18.04.3 LTS. command i used was service ssh restart Sep 26, 2019 at 7:52
  • Ah, you need to edit /etc/ssh/sshd_config (sshD) instead of /etc/ssh/ssh_config.
    – pa4080
    Sep 26, 2019 at 7:55
  • fyi: ssh_config is the client config (ie. going from the box), where as sshd_config is the server config (ie. going into the box; d=daemon)
    – guiverc
    Sep 26, 2019 at 8:02

1 Answer 1

4

In order to change the openssh-sever configuration you need to edit the /etc/ssh/sshd_config file, where d stands for daemon. The configuration file mentioned in the question - ssh_config - is dedicated to the openssh-client. Otherwise the directive you are using - PermitRootLogin no - is correct.

8
  • I just checked "sshd_config" in one of my server, and right now it's "#PermitRootLogin prohibit-password" (commented out). Do I need to uncomment and edit it to: "PermitRootLogin no" ? Thanks.
    – Jags
    Sep 27, 2019 at 20:16
  • Password authentication is set to no already: "PasswordAuthentication no"
    – Jags
    Sep 27, 2019 at 20:20
  • Hi, @Jags. Usually, within the default configuration files, the comment out lines show the default settings. I've read the man page, and I think with PermitRootLogin prohibit-password you should be able to login as root via ssh by key based authentication - for this purpose into the file /root/.ssh/authorized_key must be added any relevant public key (I will check this in practice tomorrow). On other hand PermitRootLogin no should deny any kind of login as root via ssh.
    – pa4080
    Sep 27, 2019 at 20:46
  • At all while the file /root/.ssh/authorized_key doesn't exist the two options must be equivalent.
    – pa4080
    Sep 27, 2019 at 20:50
  • Thanks for the reply. Just to be extra clear, I've enabled SSH key based login from my desktop PC, and have disabled password based logins. Now I'd like to block "root logins". Though once I login (key based login) as a non-root user, I can still become root by "sudo" or sudo su", is that correct?
    – Jags
    Sep 27, 2019 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.