Remote root access using putty

Posted on 2004-08-26
Last Modified: 2013-12-27
We are trying to minimise the ability of users logging on directly as root. By forcing them to log on as their own accounts and then su'ing to root, we can audit who has done what better.
/etc/default/login has CONSOLE=/dev/console which stops people logging is as root remotely when they use telnet.
However, now we are moving towarss SSH, I tried using PuTTY and found out that you CAN log in as root remotely with this product!

Does anyone know why this is allowed and how it can be stopped?


Question by:cjshepherd
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
LVL 34

Expert Comment

ID: 11904145
Yes. I *assume*, since you don't say, that you are using OpenSSH.

In the sshd_config file, there is a specific entry for allowing/disallowing root login via SSH. I'll have to find it and I'll post it here.

If you're not using OpenSSH, well, we're Experts, not mindreaders. Tell us what you ARE using.

Author Comment

ID: 11904290
Sorry - yes I am using OpenSSH.

LVL 34

Expert Comment

ID: 11904399
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

LVL 34

Accepted Solution

PsiCop earned 125 total points
ID: 11904431
The online man page for the the current version OpenSSH sshd_config file can be found at -->

Specifically, you are probably interested in the DenyUsers and PermitRootLogin keywords. Using either one of those you will be able to block login as root using SSH.

Author Comment

ID: 11905378
got it!  Thanks very much
LVL 34

Expert Comment

ID: 11905927
Don't forget to force the sshd daemon to re-read the config file after you change it. The changes are not effective until after SSH re-reads its config.

# kill -HUP [pid of sshd]

The pid is probably recorded in /var/run/ or something similar.

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Let's say you need to move the data of a file system from one partition to another. This generally involves dismounting the file system, backing it up to tapes, and restoring it to a new partition. You may also copy the file system from one place to…
I have been running these systems for a few years now and I am just very happy with them.   I just wanted to share the manual that I have created for upgrades and other things.  Oooh yes! FreeBSD makes me happy (as a server), no maintenance and I al…
Learn several ways to interact with files and get file information from the bash shell. ls lists the contents of a directory: Using the -a flag displays hidden files: Using the -l flag formats the output in a long list: The file command gives us mor…
Learn how to navigate the file tree with the shell. Use pwd to print the current working directory: Use ls to list a directory's contents: Use cd to change to a new directory: Use wildcards instead of typing out long directory names: Use ../ to move…

749 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question