Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 4 down vote favorite
1

I run a webserver on a VPS. For security I would like to change the default linux root username to something else. How do I do this and are there any implications I should consider before doing this?

share|improve this question
1  
+1 good one, I think changing login of id 0 is enough, but never tested and don't know if there is any side effect. – radius Jun 28 '10 at 14:36
1  
I would add: is there any system where root access is not using login root and id 0 ? – radius Jun 28 '10 at 14:48
When I was young and naive I changed the administrator username in a Windows domain. Caused no end of problems and didn't really achieve anything. Just follow Jeremy's advice below. – kaerast Jun 28 '10 at 14:52
@radius: Sure. Older servers sometimes used "wheel" or "adm". But it's always uid 0 (or at least gid 0). – BMDan Jun 28 '10 at 15:09

5 Answers

up vote 19 down vote accepted

Ah security through obscurity... The username itself is only defined in /etc/passwd and /etc/shadow so yes you could very easily go in and change it. One thing to keep in mind is the various moving parts of a server which may default to point to root which would no longer exist and potentially start breaking things and making it that much more interesting to troubleshoot.

If you're intent is to try and secure your VPS there are much more efficient ways than just changing the username and potentially causing headaches down the road. I knew an admin that did this with an old NT server by removing the administrative shares and later caused problems installing software. Security through obscurity doesn't really do anything but provide a false sense of security.

If you want to secure the box, I would start by adding yourself a non-root account, disable passwords (PasswordAuthentication no) and use SSH identity keys (PubkeyAuthentication yes)to authenticate remote logins, setup sudo access for your account and disable remote root login (PermitRootLogin no) through SSH. If you want to go a step further setup a group that is allowed to remotely connect and use the AllowGroups option to only allow accounts belonging to that group to login.

share|improve this answer
Yes, the complication is (Webhost Manager) WHM that I use. It needs "root" user and it is a gui over https. I think "PermitRootLogin no" just affects ssh and not https? I have removed password authentication and just use identity keys for ssh. Do you think it is it worth limiting remote access to IP or is it too easy to spoof IP? – Owen Jun 28 '10 at 15:45
Yes the 'PermitRootLogin' is an SSH configuration option for /etc/ssh/sshd_config and would have no affect on HTTPS. I don't use web management utilities as they are inherently insecure and prone to exploit. If you're adamant on using a web-based manager, yes I would lock it down to specific remote IP addresses and/or setup the webserver to make use of client certificate authentication. – Jeremy Bouse Jun 28 '10 at 16:03
+1 for the use of sudo, but you should also add that it is a good practice to disable root's password. – Weboide Jun 28 '10 at 20:57
2  
I wouldn't disable root's password because I have had had some instances of software installs which require the ability to run 'su' vs. 'sudo' for installation. There is also the disaster recovery case where you need to get in via console and sudo isn't working. Typically I just set the password to a random MD5 or SHA1 hash which is recorded in a software vault. – Jeremy Bouse Jun 28 '10 at 23:30
up vote 1 down vote

If you want security-through-obscurity change the port ssh listens on to something other than 22. This doesn't replace having a strong password and other security precautions, but the many automated find-ssh-servers-and-attack-them scripts will never see you.

Drop ICMP echo requests too; seems a lot of automated attacks ping first before deciding to try and break in.

share|improve this answer
up vote 3 down vote

You can disable the ability to have someone log in as root by disabling the root account. This would prevent anyone from logging in as root locally, via SSH, using su, or any other method that would require providing the root password. However, it shouldn't break anything that might require a root user named 'root.'

To do this, lock the root user's account:

passwd -l root

or replace the password hash for the root user in /etc/shadow to just an exclamation point.

share|improve this answer
I'm definitely for disabling root's access. +1 – Weboide Jun 28 '10 at 21:00
As @Jeremy_Bouse pointed out above (in the accepted answer) disabling the root account can cause problems with software that doesn't use sudo. Read his comment to the accepted answer above. – David Jan 11 '12 at 16:21
up vote 4 down vote

Offtopic: No offense, but changing the root username to something else hasn't got anything to do with security. Do you want to do this to prevent SSH brute-force login attempts?

On Topic: The username alone is not that important, it's the UID. If it stays 0, I don't think you'll encounter problems.

share|improve this answer
2  
+1. n.b. /var/spool/mail/root and /var/spool/cron/root would need to be renamed, at a minimum. – BMDan Jun 28 '10 at 14:56
You're right, forgot about this. – weeheavy Jun 28 '10 at 14:57
up vote 1 down vote 
useradd -u 0 -g root -o (somenewuser)
usermod -s /sbin/nologin root

Only time you might get into hot water is in certain recovery scenarios that require the root password. As long as you're okay with having to jump through a few extra hoops in that case (mounting the drive in another computer to modify /etc/passwd as an extreme solution, although there are other ways to fix most problems), this solution should be fine.

Alternately, just disable root login via SSH by setting:

PermitRootLogin no

in sshd_config. (Don't forget to restart sshd after changing this.)

share|improve this answer
Even if it's a great start I think it's not enough to protect against all possible local attack that could use root login – radius Jun 28 '10 at 14:47
1  
What, exactly, are you looking to protect against? You can use SELinux to completely lock the world down; there's a running example where you can log in as root, but you can't actually do anything because SELinux is protecting the box. There are other options, as well, but I'm not real clear on what other local attacks you're concerned about. Most privilege-escalation attacks use the numeric UID, anyway, so they'd be completely unaffected by changing the root user's name. – BMDan Jun 28 '10 at 14:55
@radius: Changing the username doesn't protect anything. – Satanicpuppy Jun 28 '10 at 15:03
Most of the brute force attempts I notice are using "root" so I that's why I wanted to change it. Also want to use WHM to manage my webserver, and it seems you have to be able to login as root to use this. If I had a different admin username it might improve security for both WHM login (over https) and shell login... least that was my thinking. At the moment I limit ssh login to identiy keys, but WHM can still login (by password) as "root" because it's over https not ssh. – Owen Jun 28 '10 at 15:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.