2

I have read a lot of documentation on disabling root user login via ssh for security reasons. I have set in /etc/ssh/sshd_config

PermitRootLogin no

If I disable root login then boot need to assume user name and password also.

If I set

PermitRootLogin without-password

Then it is secure to do this. If I use my sshkey is it secure? Please explain.

8
  • if I find a machine at 10.10.10.10 (or any ip address) I may not know the owner, or usernames that are allowed to login. an nmap will possibly tell me the OS that is likely to be run, but if it responds to ssh I can be pretty sure the machine knows what user 'root' will be. by allowing a keyed root access you make it [slightly] easier for hackers/baddies.
    – guiverc
    Commented Nov 25, 2017 at 5:21
  • There's a reason without-password is the default.
    – muru
    Commented Nov 25, 2017 at 5:21
  • @guiverc please elaborate in detail. If any document then give me link
    – LOKESH
    Commented Nov 25, 2017 at 5:26
  • the point i was trying to make is by allowing 'root' to login from remote; you've saved the hacker/baddie from guessing [or brute-forcing] a valid username. as starting with 'root' is likely a top (first) guess
    – guiverc
    Commented Nov 25, 2017 at 5:35
  • @guiverc - Not really . The default is "The default is prohibit-password"
    – Panther
    Commented Nov 25, 2017 at 5:35

1 Answer 1

3

From the man page man sshd

PermitRootLogin

Specifies whether root can log in using ssh(1). The argument must be yes, prohibit-password, without-password, forced-commands-only, or no. The default is prohibit-password.

If this option is set to prohibit-password or without-password, password and keyboard-interactive authentication are disabled for root.

If this option is set to forced-commands-only, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for taking remote backups even if root login is normally not allowed). All other authentication methods are disabled for root.

So, "without-password" allows root to log in via any method EXCEPT password authentication. This can include ssh keys and kerberos.

IMO this is a secure option.

See also What does 'without password' mean in sshd_config file?

2
  • After setting this, can attacker hack my server?
    – LOKESH
    Commented Nov 25, 2017 at 5:55
  • @LOKESH hacking a server is still possible in any number of ways, but at least this way you ensure that attacker cannot log in as root via ssh, i.e. hacking via ssh and root account won't be one of the ways Commented Nov 25, 2017 at 6:09

Not the answer you're looking for? Browse other questions tagged .