WebHostGear.com - the hosting resource for professionalshosting tutorials 
hosting howto webhost guide server managementFebruary 09, 2010
server management, apache tutorials, hosting tutorials, cpanel, server security
Home / Hosting Tutorials / Server Security / Disable Direct Root Logins

Disable Direct Root Logins



Printer Friendly Printer Friendly Send to a friend Send to a friend
By : ramprage Rating : Average Rating : 8.68 From 129 Voter(s)

Allowing the root user to login directly is a major security issue, we'll show you how to disable it so you can still login as root but just not directly, reducing the security issue.

This will force a hacker to have to guess 2 seperate passwords to gain root access.
(you do have 2 seperate passwords for admin and root right?)
What happens is you'll first need to login as your admin user in SSH, then switch to the super user with the su command to get root.

We also will be forcing the use of SSH protocol 2, which is a newer, more secure SSH protocol
Just a couple more ways to help your server stay safe from the bad guys. If you're using cPanel make sure you add your admin user to the 'wheel' group so that you will be able to 'su -' to root, otherwise you may lock yourself out of root.

1. SSH into your server as 'admin' and gain root access by su 

2. Copy and paste this line to edit the file for SSH logins   
pico -w /etc/ssh/sshd_config

3. Find the line
Protocol 2, 1 

4. Uncomment it and change it to look like
Protocol 2

Article provided by WebHostGear.com

5. Next, find the line
PermitRootLogin yes

6. Uncomment it and make it look like PermitRootLogin no 

7. Save the file Ctrl+X then Y then enter 

8. Now you can restart SSH
/etc/rc.d/init.d/sshd restart

Now, no one will be able to login to root with out first loggin in as admin and 'su -' to root, and you will be forcing the use of a more secure protocol. Just make sure you remember both passwords! 

New! - Need server help? Hire an Expert

Get professional help with your configuration, script installation or server issue.
Learn how we can help you with any server problem and make your server run like new. Professional staff will contact you, after submitting a quote request, by phone or email.

Rate this Article :

1

2

3

4

5

6

7

8

9

10
Poor Excellent
Sources
Thanks to foggy

Related Articles


� Guide to Chkrootkit - checking for intruders
� Creating a Welcome message for SSH logins


Discuss this article with others in our new hosting forums

Comments / Feedback

Just Asking
This though breaks DNS sycronization in cPanel as it requires root login to sync zones files across servers.
Sam
Hi, try this : #LoginGraceTime 600 PermitRootLogin without-password #StrictModes yes It should fix the DNS sycronization problem.
vera
named has failed, please contact the sysadmin (result was "named is not running"). Feb 10 14:57:52 server named: named shutdown failed Feb 10 14:57:52 server named: named: user 'named' unknown Feb 10 14:57:52 server named: named startup failed
Aingaran
Can you specify more than 1 port for ssh? IE, 22 & 222?
Ravindra
please send me uttorials about linux networking
qwe010
i do

put i can't forcing the use ?

Vishal
Great Thanks,

It worked well
Remus
excellent, thank you.
Anthony
I followed the steps. but my linx still allows direct root logins.
Jaop
Excellent Ideas ! Thank you !
Clemme
Thanks a lot dude, works like a charm.

 Add Comment
Name
Email
Image Code
Refresh Image

Comments / Feedback



Our site offers free hosting tutorials, cpanel tutorial, web hosting news, shell commands, running a web hosting business, dedicated guides, linux tutorial, apache install, home web server, web server guide, ssh commands, dedicated servers, DNS nameservers, chkrootkit, apf firewall, exim configuration, server compromised, cron backup solution, ftp backup script

Server Tutorials


WebHostGear Reviewed by Ping Zine - Click here

Links:
Lunarpages Coupon