Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

I have a linux server running centos, and while hardending the SSH server, I asked myself: Is there a reason to disable root login, when only I (assuming my IP address is static, and i have direct access to internet i.e no routers etc) can access the server (ssh daemon running on port different than 22, tcp connections to that port are accepted only from my IP, the default policy is DROP, using iptables firewall) ?

share|improve this question
The Internet is made of routers. What do you mean by "no router" ? – Tom Leek Oct 25 '11 at 19:11
i meant that my internet connection is not shared between other computers in my house – develroot Oct 25 '11 at 19:18
Yeah, but do you really mean that you have total trust in (the interns that work at) your ISP ? – Tom Leek Oct 25 '11 at 19:20
1  
I wouldn't choose to leave myself open to any threat no matter how remote just so I didn't have to type: su – k to the z Oct 25 '11 at 19:40
1  
@develroot: if SSH is inherently secure why do you feel the need to restrict the client IP ? If restricting to a single IP is needed, what do you do about the people at the ISP who are perfectly capable of hijacking your IP at will ? – Tom Leek Oct 25 '11 at 20:16
show 1 more comment

5 Answers

up vote 9 down vote accepted

Here's one: Multiple lines of defense.

share|improve this answer
up vote 8 down vote

If only your computer (that's a very different thing from you) can access the server, then anyone who gains access to your computer could try to access your server.

Why not protect it with another security measure? I'd disable the root login.

share|improve this answer
up vote 6 down vote

Yes. Always disable remote root login.

Logging in as a user creates an audit trail of who logged in before they SU to root.

SuDo reduces accidents by restricting commands to a reduced "remotely available" set. SuDo scripting can also request and log detailed admin activity reports, snapshot file systems, backup changed files, etc..

SSH remote commands can execute without a terminal shell further reducing the attack vector for compromised accounts.

share|improve this answer
up vote 3 down vote

First thing that comes to mind to me is IP Spoofing?

share|improve this answer
1  
-1 IP Spoofing over an SSL channel would be extremely difficult to acheive and does not strike me as feasible. – ephrack Oct 27 '11 at 10:15
@espengra: this would be spoofing the client IP address. – Piskvor Oct 27 '11 at 20:17
up vote 2 down vote

Yes.

It helps you avoid doing stupid things while remotely logged in as root. Ever tried rebooting a system you've remotely bricked after doing something dumb?

Mike

share|improve this answer
Good advice in general, but 1) that doesn't stop a sudo reboot, and 2) there are better tools for that (e.g. molly-guard). – Piskvor Oct 27 '11 at 20:19
When not running as root, the things you can do to permanently damage-disable-bork you system are much more limited in scope. I'm not saying it's THE protection mechanism, but it's a darn good start. – MToecker Oct 31 '11 at 17:57
I don't deny that your points are very good - as you say, it's a good protection mechanism, when coupled with others; I'd say that we're violently in agreement ;) (for example, not-being-root has saved me several times from accidentaly doing stuff like chmod 500 -R . / (expl.: doing that in / will mess up your files' permissions in a way that renders the system practically unusable)) – Piskvor Oct 31 '11 at 18:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.