-1

Lot of articles recommend deactivating ssh for root user with PermitRootLogin no in /etc/ssh/sshd_config. There is also a lot of questions on serverfault about implementing root ssh deactivation.

But what is motivation for that?

It makes the attacker to guess the user name in addition. But shouldn't the cryptographic strength of public-private keys and RSA encryption be enough?

I am asking not just out of curiosity, but because using non-root user requires additional trade-offs in ansible usage: pipelining (compatibility) or allow_world_readable_tmpfiles(security).

Improve this question
4
  • your ansible statement is false
    – Jacob Evans
    Jan 26, 2017 at 11:16
  • 1
    @JacobEvans I'll prepare minimal example, which describes my context ans post as separate question
    – geekQ
    Jan 26, 2017 at 11:18
  • !requiretty for you sudo policy probably solves your second question
    – Jacob Evans
    Jan 26, 2017 at 11:22
  • @TimBrigham Yes, is duplicate, thanks! I searched, but did not find this other question since question title does not contain ssh
    – geekQ
    Jan 27, 2017 at 7:20

2 Answers 2

Reset to default
9

  1. every system has a root user, making it 1 step easier up brute force your system.

  2. audit trails are impossible without named accounts

  3. ansible uses ssh/winrm/apis (like nxos) all using standards and all supporting named accounts, kerberos, public key and password authentication.

Improve this answer
1

The root account is prize target for attackers as it is root and it is a default/predictable account to target for brute force attacks. If an attacker needs to brute force the username as well as the password the attack will take a lot longer to be successful and when it is successful it will not be against the root account, so the impact may be limited.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.