Re: Why Disable Root ssh login?
Grok Mogger wrote:
I've often seen this touted as a good security measure and I've always
wondered why. I can think of a few possibilities, but I really don't
know. Could someone please explain it to me?
Thanks,
- GM
1. When a hacker tries to attack a site he (or she) has to guess 2
separate strings - the username and the password. The former is often
easier to guess and is not as well guarded. There is however a bit of
guessing involved in finding a username. For root this is not the case.
You don't have to guess the username "root" - it's always there. If you
look in your logs you'll find that username guessing is not all trivial.
There's another important aspect as well: the number of users that are
allowed external access. The more users, the easier it is to find a
user/password combination that works. (Think of the username/password
combination as one string with a newline somewhere in it. As the number
of strings increase it will get easier to "guess" or brute force attack
them). If you regard the root/password as one string the first 5 letters
in the string are given - "root" and the newline. The amount of guessing
is thus reduced compared to a situation where "root" is not allowed.
See 5 below as well.
2. If someone should get access to the computer as an ordinary user, you
know that the possible amount of damage to the system is lower than if
someone got root access. This means that you should do more to limit the
possibility to get root access.
3. There is a practical side to the problem as well. There are no
reasons for anyone to have external root access, but often you want your
computer to be reachable from outside for some users (is there no need
for this, you should disable external access for all users, and you
should always allow external access only to users in need of it). The
reason is stated above.
4. Hackers are more interested in getting root access than ordinary user
access as well.
5. To get root access to a computer were ssh to root etc is disallowed,
the hacker has to guess 3 different strings. The username/password for
a user as well as the password for root. This is obviously harder than
guessing only the root password. Comparing to external root access this
means the hacker has to guess 2 more strings when external root access
is disallowed!
All together this means you shouldn't allow external root access.
/Erik
Reply to: