I run a webserver on a VPS. For security I would like to change the default linux root username to something else. How do I do this and are there any implications I should consider before doing this?
-
1+1 good one, I think changing login of id 0 is enough, but never tested and don't know if there is any side effect.– radiusJun 28, 2010 at 14:36
-
1I would add: is there any system where root access is not using login root and id 0 ?– radiusJun 28, 2010 at 14:48
-
When I was young and naive I changed the administrator username in a Windows domain. Caused no end of problems and didn't really achieve anything. Just follow Jeremy's advice below.– WheresAliceJun 28, 2010 at 14:52
-
@radius: Sure. Older servers sometimes used "wheel" or "adm". But it's always uid 0 (or at least gid 0).– BMDanJun 28, 2010 at 15:09
5 Answers
Ah security through obscurity... The username itself is only defined in /etc/passwd
and /etc/shadow
so yes you could very easily go in and change it. One thing to keep in mind is the various moving parts of a server which may default to point to root
which would no longer exist and potentially start breaking things and making it that much more interesting to troubleshoot.
If you're intent is to try and secure your VPS there are much more efficient ways than just changing the username and potentially causing headaches down the road. I knew an admin that did this with an old NT server by removing the administrative shares and later caused problems installing software. Security through obscurity doesn't really do anything but provide a false sense of security.
If you want to secure the box, I would start by adding yourself a non-root account, disable passwords (PasswordAuthentication no
) and use SSH identity keys (PubkeyAuthentication yes
)to authenticate remote logins, setup sudo access for your account and disable remote root login (PermitRootLogin no
) through SSH. If you want to go a step further setup a group that is allowed to remotely connect and use the AllowGroups
option to only allow accounts belonging to that group to login.
-
Yes, the complication is (Webhost Manager) WHM that I use. It needs "root" user and it is a gui over https. I think "PermitRootLogin no" just affects ssh and not https? I have removed password authentication and just use identity keys for ssh. Do you think it is it worth limiting remote access to IP or is it too easy to spoof IP?– OwenJun 28, 2010 at 15:45
-
Yes the 'PermitRootLogin' is an SSH configuration option for /etc/ssh/sshd_config and would have no affect on HTTPS. I don't use web management utilities as they are inherently insecure and prone to exploit. If you're adamant on using a web-based manager, yes I would lock it down to specific remote IP addresses and/or setup the webserver to make use of client certificate authentication. Jun 28, 2010 at 16:03
-
+1 for the use of sudo, but you should also add that it is a good practice to disable root's password.– WeboideJun 28, 2010 at 20:57
-
2I wouldn't disable root's password because I have had had some instances of software installs which require the ability to run 'su' vs. 'sudo' for installation. There is also the disaster recovery case where you need to get in via console and sudo isn't working. Typically I just set the password to a random MD5 or SHA1 hash which is recorded in a software vault. Jun 28, 2010 at 23:30
Offtopic: No offense, but changing the root username to something else hasn't got anything to do with security. Do you want to do this to prevent SSH brute-force login attempts?
On Topic: The username alone is not that important, it's the UID. If it stays 0, I don't think you'll encounter problems.
-
2+1. n.b. /var/spool/mail/root and /var/spool/cron/root would need to be renamed, at a minimum.– BMDanJun 28, 2010 at 14:56
-
You can disable the ability to have someone log in as root by disabling the root account. This would prevent anyone from logging in as root locally, via SSH, using su
, or any other method that would require providing the root password. However, it shouldn't break anything that might require a root user named 'root.'
To do this, lock the root user's account:
passwd -l root
or replace the password hash for the root user in /etc/shadow
to just an exclamation point.
-
-
As @Jeremy_Bouse pointed out above (in the accepted answer) disabling the root account can cause problems with software that doesn't use
sudo
. Read his comment to the accepted answer above.– MeiJan 11, 2012 at 16:21
useradd -u 0 -g root -o (somenewuser)
usermod -s /sbin/nologin root
Only time you might get into hot water is in certain recovery scenarios that require the root password. As long as you're okay with having to jump through a few extra hoops in that case (mounting the drive in another computer to modify /etc/passwd as an extreme solution, although there are other ways to fix most problems), this solution should be fine.
Alternately, just disable root login via SSH by setting:
PermitRootLogin no
in sshd_config. (Don't forget to restart sshd after changing this.)
-
Even if it's a great start I think it's not enough to protect against all possible local attack that could use root login– radiusJun 28, 2010 at 14:47
-
1What, exactly, are you looking to protect against? You can use SELinux to completely lock the world down; there's a running example where you can log in as root, but you can't actually do anything because SELinux is protecting the box. There are other options, as well, but I'm not real clear on what other local attacks you're concerned about. Most privilege-escalation attacks use the numeric UID, anyway, so they'd be completely unaffected by changing the root user's name.– BMDanJun 28, 2010 at 14:55
-
-
Most of the brute force attempts I notice are using "root" so I that's why I wanted to change it. Also want to use WHM to manage my webserver, and it seems you have to be able to login as root to use this. If I had a different admin username it might improve security for both WHM login (over https) and shell login... least that was my thinking. At the moment I limit ssh login to identiy keys, but WHM can still login (by password) as "root" because it's over https not ssh.– OwenJun 28, 2010 at 15:32
If you want security-through-obscurity change the port ssh listens on to something other than 22. This doesn't replace having a strong password and other security precautions, but the many automated find-ssh-servers-and-attack-them scripts will never see you.
Drop ICMP echo requests too; seems a lot of automated attacks ping first before deciding to try and break in.