Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that I can prevent root from logging in via ssh with /etc/ssh/sshd_config but the auditors also want to see it done in /etc/security/access.conf as well.

It seems doable but I can't determine the correct syntax or order?

To test I am permitting root login in /etc/ssh/sshd_config and then attemptig to login via ssh.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

When someone logs in, the file access.conf is scanned for the first entry that matches... User root should be denied to get access from all other sources.

- : root : ALL

Quoted from the manpage

In my opinion that's just wrong. root should definitely be allowed to log in when a user has physical access to the box.

I do count IPMI as physical access, if you don't want that unplug the cable, it's the only way to be sure that you do have to stand in front of the box to have the equivalent of physical access. In some environments I even have the tendency to have a root terminal running without the need to log in -- given that proper access control to the facility is in place.

Why: sudo might fail, and giving the root password to a bunch of people so that they can login just generates problems, you'd have to change the password quite often in larger teams since there'll always be fluctuation. With an "open" root terminal there are no password worries -- all under the assumption that proper access control is there and that IPMI access is secured as well with personalized accounts

(No go downvote me for that, I can imagine that there are a ton of reasons against that but I find that to be a better -- more practical -- solution than to have a password policy for root which will sooner or later be forgotten. And if you then do need root access you have to jump in squares to get the "Password of the day")

share|improve this answer
    
Are there any services that I would need to restart after making that change? I have tried adding that line to my access.conf file and I am still able to log int remotely via ssh as root. This is the only line in my access.conf file that is not a comment.. –  ckliborn Jun 8 '11 at 21:46
    
This may be helpfu: cyberciti.biz/tips/… -- access.conf doesn't do anything to ssh itself. But you can use pam to make sure root doesn't get any access. You better play with that on a virtual machine before doing it on the real server. You'll effectively be locking root out (and by test I mean try sudo and or with the configuration so that you will still have some way of root access) –  Server Horror Jun 8 '11 at 21:52

isn't securetty the obvious way to do this instead? (access.conf depends on whether PAM is in use via SSH, which it may not be.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.