-
Title
It is required to set PermitRootLogin to yes in sshd_config when using TPAM PSM or PPM? -
Description
It is required to set PermitRootLogin to yes in sshd_config when using TPAM PSM or PPM? -
Resolution
PermitRootLogin yes, is required when:
- The functional account used is the root account or an root equivalent account (uid=0) using Password authentication or
- A root account or root equivalent account is being used for PSM using Password authentication
PermitRootLogin without-password can be set instead when:
- The functional account used is the root account or an root equivalent account (uid=0) using DSS / Public Key authentication or
- A root account or root equivalent account is being used for PSM using DSS / Public Key authentication
PermitRootLogin no can be set when:
- The functional account used is a non root account using a "Delegation Prefix" (such as sudo) and
- PSM accounts being used are non root accounts
Information from man sshd_config:PermitRootLoginSpecifies whether root can login using ssh(1). The argumentmust be “yes”, “without-password”, “forced-commands-only” or“no”. The default is “yes”.If this option is set to “without-password” password authentica-tion is disabled for root. Note that other authentication meth-ods (e.g., keyboard-interactive/PAM) may still allow root tologin using a password.If this option is set to “forced-commands-only” root login withpublic key authentication will be allowed, but only if thecommand option has been specified (which may be useful for tak-ing remote backups even if root login is normally not allowed).All other authentication methods are disabled for root.If this option is set to “no” root is not allowed to login.