Re: PermitRootLogin=yes versus su

From: Ian Gregory (i.h.gregory@herts.ac.uk)
Date: 01/26/03 

From: Ian Gregory <i.h.gregory@herts.ac.uk>
Date: 26 Jan 2003 18:25:00 GMT

Bill Lewis Clark wrote:

> A long-standing pet peeve of mine is the nearly universal belief that
> remote root logins via SSH are somehow less secure than connecting as
> a regular user and using su to become root.

> Can anyone come up with some GOOD reasons to prefer su to direct root
> logins?

I think you have missed the point slightly. There are those of us
who would advise NEVER logging in to a system as root, even locally
(and not su'ing to root either for that matter).

OK, so you have to get root when you first set up the sytem in order
to run visudo and set up your sudoers file but after that you can
forget about root unless you need to boot the system single user.
All admin can be done using sudo to get UID 0.

Given that you don't allow local logins as root, why should you allow
them via ssh?

Relevant Pages

  • Reasoning behind a default remote root login ?
    ... using ssh. ... remote root logins alltogether. ... Does anyone know why OpenBSD allows remote root ...
    (comp.unix.bsd.openbsd.misc)
  • Re: PermitRootLogin=yes versus su
    ... > a regular user and using su to become root. ... > Back in the days before strong encryption, when remote access was done ... > However, we now have SSH. ...
    (comp.security.ssh)
  • PermitRootLogin=yes versus su
    ... a regular user and using su to become root. ... Back in the days before strong encryption, when remote access was done ... However, we now have SSH. ... Logging in as a regular user via SSH, then using su to become root, ...
    (comp.security.ssh)
  • Re: X11 forwarding under su through ssh
    ... but it doesn't seem to solve the problem of becoming another user from root ... case of ssh you would need to know the users password to ssh into their id, ... > root logins, and the other listening on 0.0.0.0 and forbidding root ...
    (comp.os.linux.x)
  • Re: X11 forwarding under su through ssh
    ... but it doesn't seem to solve the problem of becoming another user from root ... case of ssh you would need to know the users password to ssh into their id, ... > root logins, and the other listening on 0.0.0.0 and forbidding root ...
    (comp.unix.solaris)