How to disable the direct root login through SSH in solaris server
How to disable the direct root login through SSH in solaris server.
==================================================
Here we are going to discuss that how we can disable the direct root login through ssh in a server.
For achiving this goal we need to edit the sshd configuration file in the server
Steps
===========
1.Take the back up of /etc/ssh/sshd_config file
2.change the PermitRootLogin entry from yes to no
Before the change
==============
bash-3.00# cat /etc/ssh/sshd_config | grep -i permit
# If PermitEmptyPasswords is no, pass PAM_DISALLOW_NULL_AUTHTOK
PermitEmptyPasswords no
# Are root logins permitted using sshd.
PermitRootLogin yes
After the change
=============
# If PermitEmptyPasswords is no, pass PAM_DISALLOW_NULL_AUTHTOK
PermitEmptyPasswords no
# Are root logins permitted using sshd.
PermitRootLogin no
bash-3.00#
3. Restart the sshd service in the server
bash-3.00# svcadm restart svc:/network/ssh:default
After restting the ssh service the root login will be disabled.
Below are some session logs for your better understanding.
================================================
bash-3.00# uname -a
SunOS unknown 5.10 Generic_141445-09 i86pc i386 i86pc
bash-3.00# cat /etc/ssh/sshd_config | grep -i permit
# If PermitEmptyPasswords is no, pass PAM_DISALLOW_NULL_AUTHTOK
PermitEmptyPasswords no
# Are root logins permitted using sshd.
PermitRootLogin yes
bash-3.00# cp -p /etc/ssh/sshd_config /etc/ssh/sshd_config_orig
bash-3.00# vi /etc/ssh/sshd_config
“/etc/ssh/sshd_config” 156 lines, 5026 characters
#
# Copyright 2009 Sun Microsystems, Inc. All rights reserved.
# Use is subject to license terms.
#
# ident “@(#)sshd_config 1.9 09/04/30 SMI”
#
# Configuration file for sshd(1m)
# Protocol versions supported
#
# The sshd shipped in this release of Solaris has support for major versions
# 1 and 2. It is recommended due to security weaknesses in the v1 protocol
# that sites run only v2 if possible. Support for v1 is provided to help sites
# with existing ssh v1 clients/servers to transition.
# Support for v1 may not be available in a future release of Solaris.
#
# To enable support for v1 an RSA1 key must be created with ssh-keygen(1).
# RSA and DSA keys for protocol v2 are created by /etc/init.d/sshd if they
# do not already exist, RSA1 keys for protocol v1 are not automatically created.
# Uncomment ONLY ONE of the following Protocol statements.
# Only v2 (recommended)
Protocol 2
# Both v1 and v2 (not recommended)
#Protocol 2,1
# Only v1 (not recommended)
#Protocol 1
# Listen port (the IANA registered port number for ssh is 22)
Port 22
# The default listen address is all interfaces, this may need to be changed
# if you wish to restrict the interfaces sshd listens on for a multi homed host.
# Multiple ListenAddress entries are allowed.
# IPv4 only
#ListenAddress 0.0.0.0
# IPv4 & IPv6
ListenAddress ::
/permit
# Maximum number of retries for authentication
# Default is 6. Default (if unset) for MaxAuthTriesLog is MaxAuthTries / 2
MaxAuthTries 6
MaxAuthTriesLog 3
# Are logins to accounts with empty passwords allowed.
# If PermitEmptyPasswords is no, pass PAM_DISALLOW_NULL_AUTHTOK
# to pam_authenticate(3PAM).
PermitEmptyPasswords no
# To disable tunneled clear text passwords, change PasswordAuthentication to no.
PasswordAuthentication yes
# Use PAM via keyboard interactive method for authentication.
# Depending on the setup of pam.conf(4) this may allow tunneled clear text
# passwords even when PasswordAuthentication is set to no. This is dependent
# on what the individual modules request and is out of the control of sshd
# or the protocol.
PAMAuthenticationViaKBDInt yes
# Are root logins permitted using sshd.
# Note that sshd uses pam_authenticate(3PAM) so the root (or any other) user
# maybe denied access by a PAM module regardless of this setting.
# Valid options are yes, without-password, no.
PermitRootLogin no
# sftp subsystem
Subsystem sftp /usr/lib/ssh/sftp-server
# SSH protocol v1 specific options
#
# The following options only apply to the v1 protocol and provide
# some form of backwards compatibility with the very weak security
# of /usr/bin/rsh. Their use is not recommended and the functionality
# will be removed when support for v1 protocol is removed.
# Should sshd use .rhosts and .shosts for password less authentication.
IgnoreRhosts yes
RhostsAuthentication no
# Rhosts RSA Authentication
# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts.
“/etc/ssh/sshd_config” 156 lines, 5025 characters
bash-3.00# cat /etc/ssh/ssh
ssh_config ssh_host_dsa_key ssh_host_dsa_key.pub ssh_host_rsa_key ssh_host_rsa_key.pub sshd_config sshd_config_orig
bash-3.00# cat /etc/ssh/sshd_config | grep -i permit
# If PermitEmptyPasswords is no, pass PAM_DISALLOW_NULL_AUTHTOK
PermitEmptyPasswords no
# Are root logins permitted using sshd.
PermitRootLogin no
bash-3.00# svcadm restart svc:/network/ssh:default
bash-3.00#
=========================================================
Hope you this helped you.
Thanks !!!
