6

I have a linux server running centos, and while hardending the SSH server, I asked myself: Is there a reason to disable root login, when only I (assuming my IP address is static, and i have direct access to internet i.e no routers etc) can access the server (ssh daemon running on port different than 22, tcp connections to that port are accepted only from my IP, the default policy is DROP, using iptables firewall) ?

6
  • The Internet is made of routers. What do you mean by "no router" ?
    – Tom Leek
    Oct 25, 2011 at 19:11
  • i meant that my internet connection is not shared between other computers in my house
    – user2639
    Oct 25, 2011 at 19:18
  • Yeah, but do you really mean that you have total trust in (the interns that work at) your ISP ?
    – Tom Leek
    Oct 25, 2011 at 19:20
  • 2
    I wouldn't choose to leave myself open to any threat no matter how remote just so I didn't have to type: su
    – k to the z
    Oct 25, 2011 at 19:40
  • 1
    @develroot: if SSH is inherently secure why do you feel the need to restrict the client IP ? If restricting to a single IP is needed, what do you do about the people at the ISP who are perfectly capable of hijacking your IP at will ?
    – Tom Leek
    Oct 25, 2011 at 20:16

5 Answers 5

10

Here's one: Multiple lines of defense.

9

Yes. Always disable remote root login.

Logging in as a user creates an audit trail of who logged in before they SU to root.

SuDo reduces accidents by restricting commands to a reduced "remotely available" set. SuDo scripting can also request and log detailed admin activity reports, snapshot file systems, backup changed files, etc..

SSH remote commands can execute without a terminal shell further reducing the attack vector for compromised accounts.

8

If only your computer (that's a very different thing from you) can access the server, then anyone who gains access to your computer could try to access your server.

Why not protect it with another security measure? I'd disable the root login.

4

Yes.

It helps you avoid doing stupid things while remotely logged in as root. Ever tried rebooting a system you've remotely bricked after doing something dumb?

Mike

3
  • Good advice in general, but 1) that doesn't stop a sudo reboot, and 2) there are better tools for that (e.g. molly-guard). Oct 27, 2011 at 20:19
  • When not running as root, the things you can do to permanently damage-disable-bork you system are much more limited in scope. I'm not saying it's THE protection mechanism, but it's a darn good start.
    – MToecker
    Oct 31, 2011 at 17:57
  • I don't deny that your points are very good - as you say, it's a good protection mechanism, when coupled with others; I'd say that we're violently in agreement ;) (for example, not-being-root has saved me several times from accidentaly doing stuff like chmod 500 -R . / (expl.: doing that in / will mess up your files' permissions in a way that renders the system practically unusable)) Oct 31, 2011 at 18:20
2

First thing that comes to mind to me is IP Spoofing?

2
  • 1
    -1 IP Spoofing over an SSL channel would be extremely difficult to acheive and does not strike me as feasible.
    – efr4k
    Oct 27, 2011 at 10:15
  • @espengra: this would be spoofing the client IP address. Oct 27, 2011 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy