I have a linux server running centos, and while hardending the SSH server, I asked myself: Is there a reason to disable root login, when only I (assuming my IP address is static, and i have direct access to internet i.e no routers etc) can access the server (ssh daemon running on port different than 22, tcp connections to that port are accepted only from my IP, the default policy is DROP, using iptables firewall) ?

  • The Internet is made of routers. What do you mean by "no router" ? – Tom Leek Oct 25 '11 at 19:11
  • i meant that my internet connection is not shared between other computers in my house – user2639 Oct 25 '11 at 19:18
  • Yeah, but do you really mean that you have total trust in (the interns that work at) your ISP ? – Tom Leek Oct 25 '11 at 19:20
  • 2
    I wouldn't choose to leave myself open to any threat no matter how remote just so I didn't have to type: su – k to the z Oct 25 '11 at 19:40
  • 1
    @develroot: if SSH is inherently secure why do you feel the need to restrict the client IP ? If restricting to a single IP is needed, what do you do about the people at the ISP who are perfectly capable of hijacking your IP at will ? – Tom Leek Oct 25 '11 at 20:16

Here's one: Multiple lines of defense.


Yes. Always disable remote root login.

Logging in as a user creates an audit trail of who logged in before they SU to root.

SuDo reduces accidents by restricting commands to a reduced "remotely available" set. SuDo scripting can also request and log detailed admin activity reports, snapshot file systems, backup changed files, etc..

SSH remote commands can execute without a terminal shell further reducing the attack vector for compromised accounts.


If only your computer (that's a very different thing from you) can access the server, then anyone who gains access to your computer could try to access your server.

Why not protect it with another security measure? I'd disable the root login.



It helps you avoid doing stupid things while remotely logged in as root. Ever tried rebooting a system you've remotely bricked after doing something dumb?


  • Good advice in general, but 1) that doesn't stop a sudo reboot, and 2) there are better tools for that (e.g. molly-guard). – Piskvor left the building Oct 27 '11 at 20:19
  • When not running as root, the things you can do to permanently damage-disable-bork you system are much more limited in scope. I'm not saying it's THE protection mechanism, but it's a darn good start. – MToecker Oct 31 '11 at 17:57
  • I don't deny that your points are very good - as you say, it's a good protection mechanism, when coupled with others; I'd say that we're violently in agreement ;) (for example, not-being-root has saved me several times from accidentaly doing stuff like chmod 500 -R . / (expl.: doing that in / will mess up your files' permissions in a way that renders the system practically unusable)) – Piskvor left the building Oct 31 '11 at 18:20

First thing that comes to mind to me is IP Spoofing?

  • 1
    -1 IP Spoofing over an SSL channel would be extremely difficult to acheive and does not strike me as feasible. – efr4k Oct 27 '11 at 10:15
  • @espengra: this would be spoofing the client IP address. – Piskvor left the building Oct 27 '11 at 20:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy