3

I am new to Linux/Ubuntu and I have a Ubuntu instance in GCP and want to restrict the root access from the outside like ssh and putty, but however I want to access root by using the command su root . Is there any way to achieve that it will good for security.

I tried PermitRootLogin no in /etc/ssh/ssh_config but it didn't work. I can still access root using putty.

Thanks.

  • Hello. Did you restart the ssh service after the configuration change - sudo systemctl restart sshd? Which version is your Ubuntu? – pa4080 Sep 26 '19 at 7:50
  • yes i did, version Ubuntu 18.04.3 LTS. command i used was service ssh restart – Ayush Verma Sep 26 '19 at 7:52
  • Ah, you need to edit /etc/ssh/sshd_config (sshD) instead of /etc/ssh/ssh_config. – pa4080 Sep 26 '19 at 7:55
  • fyi: ssh_config is the client config (ie. going from the box), where as sshd_config is the server config (ie. going into the box; d=daemon) – guiverc Sep 26 '19 at 8:02
  • Hey, thanks yes it's working now. – Ayush Verma Sep 26 '19 at 8:02
4

In order to change the openssh-sever configuration you need to edit the /etc/ssh/sshd_config file, where d stands for daemon. The configuration file mentioned in the question - ssh_config - is dedicated to the openssh-client. Otherwise the directive you are using - PermitRootLogin no - is correct.

| improve this answer | |
  • I just checked "sshd_config" in one of my server, and right now it's "#PermitRootLogin prohibit-password" (commented out). Do I need to uncomment and edit it to: "PermitRootLogin no" ? Thanks. – Jags Sep 27 '19 at 20:16
  • Password authentication is set to no already: "PasswordAuthentication no" – Jags Sep 27 '19 at 20:20
  • Hi, @Jags. Usually, within the default configuration files, the comment out lines show the default settings. I've read the man page, and I think with PermitRootLogin prohibit-password you should be able to login as root via ssh by key based authentication - for this purpose into the file /root/.ssh/authorized_key must be added any relevant public key (I will check this in practice tomorrow). On other hand PermitRootLogin no should deny any kind of login as root via ssh. – pa4080 Sep 27 '19 at 20:46
  • At all while the file /root/.ssh/authorized_key doesn't exist the two options must be equivalent. – pa4080 Sep 27 '19 at 20:50
  • Thanks for the reply. Just to be extra clear, I've enabled SSH key based login from my desktop PC, and have disabled password based logins. Now I'd like to block "root logins". Though once I login (key based login) as a non-root user, I can still become root by "sudo" or sudo su", is that correct? – Jags Sep 27 '19 at 21:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.