0

So if I edit my /etc/ssh/sshd_config file, there's a thing PermitRootLogin where you can turn off root logins.

However this also means I can't use file uploading services like Filezilla because of permissions errors since I can't call "sudo" from Filezilla from one of my non-root accounts.

So, one alternative is to leave root logins on.

If my password is very long (32+ characters) and very high-entropy (lower-case, upper-case, special symbols, numbers, etc), won't this thwart brute force attacks entirely? Is there any risk to leaving root logins on otherwise?

1

You are already aware of the primary reason why root logins should be disabled by sshd_config. Brute force attacks, by definition, can be relentless and given enough time, any password can be cracked. This is true since attackers already know 50% of the information needed to gain access to your machine: a valid privileged username.

That said, very long, high-entropy passwords certainly reduce the risks of actually being penetrated.

The answer to your question is: No, a very strong password will not completely thwart brute force attacks. They will only help mitigate the risk.

In practical terms, if you are managing a high value (to hackers) computer it would be very unwise to allow ssh root access (or root logins generally). But if that were the case, policies would be in place to prevent this being done.

If you are comfortable with the risk, go for it. The worst that could happen is that someone installs a rootkit and renders your computer useless.

  • Brute force attacks, by definition, can be relentless and given enough time, any password can be cracked: Even 32-length high-entropy passwords, realistically speaking? – user712268 Jul 14 '17 at 0:01
  • Give NSA a reason to seize your computer and I can guarantee you that they will crack whatever passwords you have on it. There is absolutely no such thing as a password that cannot be cracked. – jones0610 Jul 14 '17 at 0:04
  • How do people transfer files (e.g. website files) if they have root disabled? – user712268 Jul 14 '17 at 0:06
  • That's not the question you asked. If you have a different question, please open a new question. – jones0610 Jul 14 '17 at 0:08
  • I transfer files via scp and allow root login with keys only – Panther Jul 14 '17 at 0:09
1

This is probably more an opinion than anything else. I suggest you use keys so root login "without-pasword" and configure iptables to lock users out after a certain number of failed attempts. With file transfer you may want to increase the attempts.

Add/edit to /etc/ssh/sshd_config

PermitRootLogin without-password

What does 'without password' mean in sshd_config file?

Make sure you can log in with a key first

http://bodhizazen.com/Tutorials/SSH_keys/

Then disable password authentication.

iptables

iptables -A INPUT -p tcp -m tcp --dport 22 -m tcp -m state --state NEW -m recent --set --name SSH --rsource

iptables -A INPUT -p tcp -m tcp --dport 22 -m recent --update --seconds 600 --hitcount 20 --rttl --name SSH --rsource -j REJECT --reject-with icmp-host-prohibited

iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

You can increase or decrease the hit count if you so desire

See http://bodhizazen.com/Tutorials/iptables

With those changes, keys and/or a few iptables rules, I think it is reasonable to allow root to log in via ssh.

  • So without-password doesn't mean "you can log in without a password" but rather "the password will not work for logging in, you must use a key"? – user712268 Jul 14 '17 at 0:13
  • without-password disables password login via ssh. You can log in with other tools such as keys or kerberos – Panther Jul 14 '17 at 0:14

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.