4

I run a webserver on a VPS. For security I would like to change the default linux root username to something else. How do I do this and are there any implications I should consider before doing this?

4
  • 1
    +1 good one, I think changing login of id 0 is enough, but never tested and don't know if there is any side effect.
    – radius
    Jun 28, 2010 at 14:36
  • 1
    I would add: is there any system where root access is not using login root and id 0 ?
    – radius
    Jun 28, 2010 at 14:48
  • When I was young and naive I changed the administrator username in a Windows domain. Caused no end of problems and didn't really achieve anything. Just follow Jeremy's advice below. Jun 28, 2010 at 14:52
  • @radius: Sure. Older servers sometimes used "wheel" or "adm". But it's always uid 0 (or at least gid 0).
    – BMDan
    Jun 28, 2010 at 15:09

5 Answers 5

19

Ah security through obscurity... The username itself is only defined in /etc/passwd and /etc/shadow so yes you could very easily go in and change it. One thing to keep in mind is the various moving parts of a server which may default to point to root which would no longer exist and potentially start breaking things and making it that much more interesting to troubleshoot.

If you're intent is to try and secure your VPS there are much more efficient ways than just changing the username and potentially causing headaches down the road. I knew an admin that did this with an old NT server by removing the administrative shares and later caused problems installing software. Security through obscurity doesn't really do anything but provide a false sense of security.

If you want to secure the box, I would start by adding yourself a non-root account, disable passwords (PasswordAuthentication no) and use SSH identity keys (PubkeyAuthentication yes)to authenticate remote logins, setup sudo access for your account and disable remote root login (PermitRootLogin no) through SSH. If you want to go a step further setup a group that is allowed to remotely connect and use the AllowGroups option to only allow accounts belonging to that group to login.

4
  • Yes, the complication is (Webhost Manager) WHM that I use. It needs "root" user and it is a gui over https. I think "PermitRootLogin no" just affects ssh and not https? I have removed password authentication and just use identity keys for ssh. Do you think it is it worth limiting remote access to IP or is it too easy to spoof IP?
    – Owen
    Jun 28, 2010 at 15:45
  • Yes the 'PermitRootLogin' is an SSH configuration option for /etc/ssh/sshd_config and would have no affect on HTTPS. I don't use web management utilities as they are inherently insecure and prone to exploit. If you're adamant on using a web-based manager, yes I would lock it down to specific remote IP addresses and/or setup the webserver to make use of client certificate authentication. Jun 28, 2010 at 16:03
  • +1 for the use of sudo, but you should also add that it is a good practice to disable root's password.
    – Weboide
    Jun 28, 2010 at 20:57
  • 2
    I wouldn't disable root's password because I have had had some instances of software installs which require the ability to run 'su' vs. 'sudo' for installation. There is also the disaster recovery case where you need to get in via console and sudo isn't working. Typically I just set the password to a random MD5 or SHA1 hash which is recorded in a software vault. Jun 28, 2010 at 23:30
4

Offtopic: No offense, but changing the root username to something else hasn't got anything to do with security. Do you want to do this to prevent SSH brute-force login attempts?

On Topic: The username alone is not that important, it's the UID. If it stays 0, I don't think you'll encounter problems.

2
  • 2
    +1. n.b. /var/spool/mail/root and /var/spool/cron/root would need to be renamed, at a minimum.
    – BMDan
    Jun 28, 2010 at 14:56
  • You're right, forgot about this.
    – weeheavy
    Jun 28, 2010 at 14:57
3

You can disable the ability to have someone log in as root by disabling the root account. This would prevent anyone from logging in as root locally, via SSH, using su, or any other method that would require providing the root password. However, it shouldn't break anything that might require a root user named 'root.'

To do this, lock the root user's account:

passwd -l root

or replace the password hash for the root user in /etc/shadow to just an exclamation point.

2
  • I'm definitely for disabling root's access. +1
    – Weboide
    Jun 28, 2010 at 21:00
  • As @Jeremy_Bouse pointed out above (in the accepted answer) disabling the root account can cause problems with software that doesn't use sudo. Read his comment to the accepted answer above.
    – Mei
    Jan 11, 2012 at 16:21
1
useradd -u 0 -g root -o (somenewuser)
usermod -s /sbin/nologin root

Only time you might get into hot water is in certain recovery scenarios that require the root password. As long as you're okay with having to jump through a few extra hoops in that case (mounting the drive in another computer to modify /etc/passwd as an extreme solution, although there are other ways to fix most problems), this solution should be fine.

Alternately, just disable root login via SSH by setting:

PermitRootLogin no

in sshd_config. (Don't forget to restart sshd after changing this.)

4
  • Even if it's a great start I think it's not enough to protect against all possible local attack that could use root login
    – radius
    Jun 28, 2010 at 14:47
  • 1
    What, exactly, are you looking to protect against? You can use SELinux to completely lock the world down; there's a running example where you can log in as root, but you can't actually do anything because SELinux is protecting the box. There are other options, as well, but I'm not real clear on what other local attacks you're concerned about. Most privilege-escalation attacks use the numeric UID, anyway, so they'd be completely unaffected by changing the root user's name.
    – BMDan
    Jun 28, 2010 at 14:55
  • @radius: Changing the username doesn't protect anything. Jun 28, 2010 at 15:03
  • Most of the brute force attempts I notice are using "root" so I that's why I wanted to change it. Also want to use WHM to manage my webserver, and it seems you have to be able to login as root to use this. If I had a different admin username it might improve security for both WHM login (over https) and shell login... least that was my thinking. At the moment I limit ssh login to identiy keys, but WHM can still login (by password) as "root" because it's over https not ssh.
    – Owen
    Jun 28, 2010 at 15:32
1

If you want security-through-obscurity change the port ssh listens on to something other than 22. This doesn't replace having a strong password and other security precautions, but the many automated find-ssh-servers-and-attack-them scripts will never see you.

Drop ICMP echo requests too; seems a lot of automated attacks ping first before deciding to try and break in.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .