Disable root login

  • Thread starter Thread starter audunms
  • Start date Start date
A

audunms

Guest
Hi,
I wonder if it is possible to disable root user (or block root from login to the web interface/SSH/any other place than the physical server)?

I found information on how to grant another user root/admin privilegies, but not how to disable root.
 
Nemesiz said:
Just remove password from /ets/shadow file.
Click to expand...
what kind of advice is that ?

if you remove the password, then there is no password needed to login as root. fantastic if you want to open your server to everyone.

if you remove the entire line you cannot login as root at all. fantastic if you face a problem that can only be resolved as root (example: update & reboot).
 
GT1 said:
what kind of advice is that ?

if you remove the password, then there is no password needed to login as root. fantastic if you want to open your server to everyone.
Click to expand...

Look at /etc/ssh/sshd_config

PermitEmptyPasswords no

GT1 said:
if you remove the entire line you cannot login as root at all. fantastic if you face a problem that can only be resolved as root (example: update & reboot).
Click to expand...

You can use 'sudo su' or ssh key to log in with no root password as I do.

Good luck to learn :-)

edit: empty password has hash too so the line like this 'root:*:15521:0:99999:7:::" makes impossible to log in anyway except for ssh keys and sudo command.
 
Last edited:
yes, if you replace it with a * then i agree. however you stated remove, which leads to a non passworded root account. thus anyone who is on a shell can get root easily. so before your advice is going to lock the OP out of his box or open it to everyone you should be specific :P

btw: sudo is not installed by default on proxmox, you should not assume it is :cool:
 
Thank you for your answers. to elaborate, I do have physical access to the server should it be needed for some operations. From your replies, I am somewhat unsure to implement them as I ofcourse do not want to lock myself out from the system..

The reason I asked my question is that I want to be able to login remotely (via internet). I also want to be less vulnerable to brute force attacks, and therefore I thought disabling root was one step on the way. However, maybe another solution could be to lock root account for x seconds after x failed login attempts. Is this possible?

Thanks.
 
audunms said:
Thank you for your answers. to elaborate, I do have physical access to the server should it be needed for some operations. From your replies, I am somewhat unsure to implement them as I ofcourse do not want to lock myself out from the system..

The reason I asked my question is that I want to be able to login remotely (via internet). I also want to be less vulnerable to brute force attacks, and therefore I thought disabling root was one step on the way. However, maybe another solution could be to lock root account for x seconds after x failed login attempts. Is this possible?

Thanks.
Click to expand...
Hi,
Fail2Ban is the right solution for you. Search in the forum about threads for that.

Udo
 
Hi,
thnkas. I had not heard of fail2ban, but I implemented the solution for 2.x linked to in the first forum post about it, and it works perfectly fine. Thanks!

P.S. I do not know what denyhosts does, but I guess it won't matter since fail2ban seems to work fine.
 
Disabling root login (sshd_config) can cause some problem in some proxmox activity (backup, migrate, snapshot ...)?
 
You must log in or register to reply here.
Top Bottom