Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently disabled root login via ssh on my ubunutu server as I was getting quite a lot of ssh attempts with root. I did this by editing the /etc/ssh/sshd_config file and restarting ssh.

However, when I recently checked my log file again, I saw there were numerous other attempts with root in there? - The log message was "failed password" - but if this did work, why would it simply not fail at the first hurdle and say "failed - root login disallowed" or something similar?

Is there a way to tell whether I have configured this correctly?

share|improve this question
    
Try to ssh to the box login in as root with the correct password. –  user105924 Jan 4 '12 at 16:36
    
I haven't set a password for root –  Alex Coplan Jan 4 '12 at 16:38
add comment

3 Answers 3

I assume you set the PermitRootLogin to no. If this is the case, SSH will still accept the connection but then deny root login. You will see this in the logs but it will not permit root to login.

I also use the "without-password" option to permit root login only with SSH keys.

I've not dug into it but suspect this is because SSH accepts the connection and then hands the authentication process to PAM.

If you wish to block these attempts, fail2ban is a popular tool for this purpose.

http://www.fail2ban.org/wiki/index.php/Main_Page

Personally, I am not a fan of these log analyzers but they have their place.

share|improve this answer
    
right, thanks for clarifying - yes that's what I did –  Alex Coplan Jan 4 '12 at 17:13
    
I also tweak /etc/pam.d/su to only permit users in the wheel group to su to root. Then add your admins to the wheel group and/or use sudo. This provides many layers of security. –  jeffatrackaid Jan 4 '12 at 17:17
add comment

If you set :

PermitRootLogin no

and restart sshd process (/etc/init.d/sshd restart). It should disable the ability of the root user to login. Make sure that /etc/sysconfig/sshd doesn't exist and overwrite some of the settings.

The log error, upon root login will be something like (in /var/log/secure if RHEL based distro):

Failed password for root from [...]*
share|improve this answer
add comment

A tips could be to install something like sshguard to help battle bruteforce attempts. Read about it at:
http://www.sshguard.net/

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.