Ssh – Why would sshd allow root logins by default

rootSecurityssh

I'm currently working on hardening my servers against hacking- amongst other things, i'm getting a load of attempts to log on as root over ssh. While i've implemented fail2ban, i'm wondering, why root logons would be allowed by default to start with? Even with non sudo based distros, i can always log on as a normal user and switch – so i'm wondering is there any clear advantage to allowing root logons on ssh, or it just something no one bothers to change?

Best Answer

There any clear advantage to allowing root logons on ssh

There are some backup systems that need root on the remote system to actually perform a backup. It is not uncommon to see things setup with key-based authentication to perform maintenance tasks on remote systems.

I do strongly wish the default would be changed from PermitRootLogin yes to at least PermitRootLogin without-password, this would allow key-based authentication only. Remote password authentication to the root account is almost never needed.

It is becoming more common on systems (like Ubuntu) for the system to be setup with a root account with a disabled password. There isn't much risk in the default setup since there is no way to directly authenticated to an account with a disabled password.

Also consider that a brute force attempt to remotely login to root via ssh has a very low chance of being successful if you have a root account with a sufficiently complex password. Disabling the root account does provide an extra layer of security, but it may not be needed if you have a strong password. If you combine a strong password with a reactive tools like denyhosts and fail2ban there is usually almost no risk that an attempt to brute force the root password will work.

It is always a good practice to harden the system after the install is done based on the risk and the requirement for your network. A system that not critical and has no user data doesn't really need the same level of hardening as the system that stores medical or banking records.

Related Solutions

Security – How to configure vsftpd to allow root logins

DISCLAIMER: Enabling root login for FTP is a Very Bad Idea for many, many reasons.

Edit your vsftpd.conf file, and add the following line:

userlist_deny=YES

Edit user_list and ftpusers and comment out "root".

Windows Server 2008 – Cygwin SSHd Autoblock Failed Logins

I wrote a program to block IP addresses like you're asking for a couple of years ago, but did it for a Customer as a work-for-hire. Since I ended up with some "spare" time this evening I opted to re-implement the whole thing from the ground up, write some useful documentation, and generally make it a presentable program. Since I've heard from multiple people that this would be a handy thing to have it seems like it's probably worth the time. Hopefully you, and other members of the community, can get some use out of it.

Windows sshd_block

sshd_block is a VBScript program that acts as a WMI event sink to receive Windows Event Log entries logged by sshd. It parses these log entries and acts upon them as follows:

If the IP address attempts to logon with a username flagged as "ban immediately" the IP address is banned immediately.
If the IP address attempts to logon with more frequently than is allowed in a given time period the IP address is banned.

The "ban immediately" usernames and thresholds associated with repeated logon attempts are configurable in the "Configuration" section of the script. Default settings are as follows:

Ban Immediately Usernames - administrator, root, guest
Logon attempts allowed - 5 in 120 seconds (2 minutes)
Duration of ban - 300 seconds (5 minutes)

Once a second any IP addresses that have been banned for the ban duration are unbanned (by having the black-hole route removed from the routing table).

You can download the software here and can browse the archive here.

Edit:

As of 2010-01-20 I've updated the code to support using the "Advanced Firewall" on Windows Vista / 2008 / 7 / 2008 R2 to perform black-holding of traffic via creating firewall rules (which is much more in line with the behavior of "fail2ban"). I also added some additional matching strings to catch OpenSSH versions that "invalid user" as opposed to "illegal user".

Best Answer

Related Solutions

Security – How to configure vsftpd to allow root logins

Windows Server 2008 – Cygwin SSHd Autoblock Failed Logins

Windows sshd_block

Related Topic