Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I recently disabled root login via ssh on my ubunutu server as I was getting quite a lot of ssh attempts with root. I did this by editing the /etc/ssh/sshd_config file and restarting ssh.

However, when I recently checked my log file again, I saw there were numerous other attempts with root in there? - The log message was "failed password" - but if this did work, why would it simply not fail at the first hurdle and say "failed - root login disallowed" or something similar?

Is there a way to tell whether I have configured this correctly?

share|improve this question
Try to ssh to the box login in as root with the correct password. – user105924 Jan 4 '12 at 16:36
I haven't set a password for root – Alex Coplan Jan 4 '12 at 16:38

I assume you set the PermitRootLogin to no. If this is the case, SSH will still accept the connection but then deny root login. You will see this in the logs but it will not permit root to login.

I also use the "without-password" option to permit root login only with SSH keys.

I've not dug into it but suspect this is because SSH accepts the connection and then hands the authentication process to PAM.

If you wish to block these attempts, fail2ban is a popular tool for this purpose.

Personally, I am not a fan of these log analyzers but they have their place.

share|improve this answer
right, thanks for clarifying - yes that's what I did – Alex Coplan Jan 4 '12 at 17:13
I also tweak /etc/pam.d/su to only permit users in the wheel group to su to root. Then add your admins to the wheel group and/or use sudo. This provides many layers of security. – jeffatrackaid Jan 4 '12 at 17:17

If you set :

PermitRootLogin no

and restart sshd process (/etc/init.d/sshd restart). It should disable the ability of the root user to login. Make sure that /etc/sysconfig/sshd doesn't exist and overwrite some of the settings.

The log error, upon root login will be something like (in /var/log/secure if RHEL based distro):

Failed password for root from [...]*
share|improve this answer

A tips could be to install something like sshguard to help battle bruteforce attempts. Read about it at:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.