Regresar
-
Título
SSH root logins are allowed and should not be -
Descripción
Users are able to directly log in as the "root" account, providing they supply the correct password. -
Causa
The default setting in some versions of openSSH for "PermitRootLogin" is "yes"
-
Resolución
1 - Modify the "PermitRootLogin" parameter in the relevant SSH config file.
/etc/ssh/sshd_config
Set:
PermitRootLogin no
or,
PermitRootLogin without-password
(to leave public-key root access enabled, not supported in all SSH versions )
2 - Then restart the SSH daemon:
/etc/init.d/sshd restart -
Información adicional
Authentication Services does not control the root account unless it is mapped to an AD account which we do not recommend.