Friends of mine have previously had issues with VPS security. The security was no fault of the operating system/services themselves, but mainly due to the "Control Panel" that gets forced upon you when purchasing a VPS.

I've seen flawless server setups fall to their knees because people have broken into the admin panel, and then fired up a local KVM shell.

My question for you, is the following: Is it possible to limit command line access to SSH sessions only? E.g. Disabling all Local + KVM logins.

I'd much rather the only access to be via key-based SSH logons.

  • Good advice above and you should especially listen to his first recommendation. If you firewall the console you can still get at it when you need to. If you don't offer at least a console tty, you won't be able to login to your console ever. Trouble is, you probably don't have firewall control of the router that controls the console network connection. – user36817 Jan 7 '14 at 20:34
  • While not an answer to your specific question, please note that all guests should be considered insecure to the hypervisor, as it has access to both disk and memory of the VPS. Also, please make sure what you are doing complies with the agreement you have made with your provider. – David Houde Jan 8 '14 at 2:16

If you're worried about the VPS control panel as a security vulnerability, then your best bet is to block (e.g. firewall off) access to the VPS control panel rather than disabling local login, since there's typically more you can do than just console login.

But yes, you can disable local consoles. They're started up by init; so your configuration for whichever init variant you're running will have the configuration. For example, if you're using classic SysV init, then you'll look in /etc/inittab.


tylerl is right - I'd agree that this seems to be solving the problem at the wrong place but you can change init to not start a console.

Also make sure you disable single-user mode since assumedly it would also let an attacker get root by rebooting the machine to single-user recovery mode (and resetting the root password if they like). https://askubuntu.com/questions/186176/how-to-disable-recovery-mode-single-user-mode

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.