[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: OT: Safe to access SSH server from work?

On Sat, 14 May 2011 23:15:33 +0900
Joel Rees <joel.rees@gmail.com> wrote:


> Disable root login on ssh entirely. (/etc/ssh/sshd_config has that
> enabled in my more-or-less default install. That is, I think, so you
> don't find yourself in a catch-22 when installing remotely. Should be
> in a list of things to do afterboot.)

>From /usr/share/doc/openssh-server/README.Debian:

> PermitRootLogin set to yes
> --------------------------
> This is now the default setting (in line with upstream), and people
> who asked for an automatically-generated configuration file when
> upgrading from potato (or on a new install) will have this setting in
> their /etc/ssh/sshd_config file.
> Should you wish to change this setting, edit /etc/ssh/sshd_config, and
> change:
> PermitRootLogin yes
> to:
> PermitRootLogin no
> Having PermitRootLogin set to yes means that an attacker that knows
> the root password can ssh in directly (without having to go via a user
> account). If you set it to no, then they must compromise a normal user
> account. In the vast majority of cases, this does not give added
> security; remember that any account you su to root from is equivalent
> to root - compromising this account gives an attacker access to root
> easily. If you only ever log in as root from the physical console,
> then you probably want to set this value to no.
> As an aside, PermitRootLogin can also be set to "without-password" or
> "forced-commands-only" - see sshd(8) for more details.
> The argument above is somewhat condensed; I have had this discussion
> at great length with many people. If you think the default is
> incorrect, and feel strongly enough to want to argue about it, then
> send email to debian-ssh@lists.debian.org. I will close bug reports
> claiming the default is incorrect.

foffl.sourceforge.net - Feeds OFFLine, an offline RSS/Atom aggregator
mailmin.sourceforge.net - remote access via secure (OpenPGP) email
ssuds.sourceforge.net - A Simple Sudoku Solver and Generator

Reply to: