8

I have a cloud server with only a root user. I SSH to it using RSA keys only. To make it more secure, I wanted to disable the password feature. I know that this can be done by editing the /etc/ssh/sshd_config file and changing PermitRootLogin yes to PermitRootLogin without-password. I was wondering if simply deleting the root password via passwd -d root would be the equivalent (assuming I do not create more users or new users have their passwords deleted too). Are there any security issues with one approach verses the other?

2 Answers 2

11

Using public key authentication bypasses other authentication methods, so there's no need to use PermitRootLogin without-password, it's dangerous if someone tries to login as root and is not forced to present a public key.

To accomplish what you want, disabling password authentication in sshd, use PasswordAuthentication no in your sshd_config.

This setting will not affect the contents of /etc/shadow, where your user passwords are stored. If another application wants to authenticate via password (say CUPS for example), this will still work.

If you want to disable this, deleting a users password with the command stated above will not work. It allow password-less logins for a given user, that's definitly not added security.

Issuing passwd -l <user> will accomplish what you intended. Keep in mind though that other apps than ssh might have a problem with that because they expect password authentication in their default setup (sudo, su, CUPS, etc.)

Quoting from man passwd:

-l, --lock
           Lock the password of the named account. This option disables a password by changing it to a value which matches no possible encrypted value (it adds a ´!´ at the beginning of the password).

           Note that this does not disable the account. The user may still be able to login using another authentication token (e.g. an SSH key). To disable the account, administrators should use usermod
           --expiredate 1 (this set the account's expire date to Jan 2, 1970).

           Users with a locked password are not allowed to change their password.
2

Absolutely not, removing the root password would be a great security risk, if you want to modify the root password I would suggest that you set a strong random password for the root user. Even tho /etc/shadow

Now you have root user locked down for SSH access only to your SSH key, your next step would be to check which other users have shell access and remove it if not needed, and do the same for any additional user accounts you may create and keep SSH access only to the root user.

If you do choose to remove the password for any user, it should have also shell access removed in /etc/passwd by setting the shell to /sbin/nologin.

A different approach would be to disable password login for SSH for all users and allow public key authentication only.

ChallengeResponseAuthentication no
PasswordAuthentication no
UsePAM no

Also ensure that the public key authentication is allowed in /etc/ssh/sshd_config :

PubkeyAuthentication yes

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .