[SOLVED] Newbie - what to do about huge number attempted ssh logins

nomb · 09-14-2010, 05:06 PM

Quote:

Originally Posted by cnmoore

Sorry, I don't know what you mean about "SSH'ing to root requires the root account to be enabled. Bad. When you SSH in the first time the connection is encrypted already. "

He is saying that being able to ssh in as root in any way, shape or form, still requires you to allow root to login remotely.

Which is bad.

Quote:

Originally Posted by cnmoore

How would a person log in as root if root wasn't enabled? You've lost me. And are you saying that su root is better than SSH root?

A user wouldn't login as root. That is the point. You login as your regular user, and then use something to escalate your privileges. (su, sudo)

Yes su root is better the ssh root because you aren't connecting remote as root. However sudo root is even better than su root...

nomb

cnmoore · 09-14-2010, 06:23 PM

How am I connecting remote if I am connecting via SSH to another name on the same server? Nothing goes out through PuTTY, it's all happening within the server. Not even going out on the hosts's LAN. Using su requires entering a password which gets transitted via PuTTY.

Edit: I found sudo. Need to be root to see it. So I will add 'me' to the /root/sudoers.txt?

The existing entries look like this, which confuses me. Name1 and name2 are host's techs.
root ALL=(ALL) ALL
name1 ALL = PASSWD: ALL
name1 ALL = NOPASSWD: ADMIN
name2 ALL = NOPASSWD: ADMIN
name2 ALL = PASSWD: ALL
admin ALL = NOPASSWD: ADMIN

Would I add
me ALL = NOPASSWD: ROOT

gilead · 09-14-2010, 09:59 PM

You may be working locally, but unless your /etc/ssh/sshd_config file contains "PermitRootLogin no" (my version defaults to yes unless you specifically set it to no) then someone can remotely try to access the root account by guessing the password.

To set up sudo I use the visudo command. I don't recommend using the keywords ALL and NOPASSWD together since they provide full root access if someone guesses that account's password.

cnmoore · 09-14-2010, 10:24 PM

Where do I get visudo?

Code:

[root@www sbin]# rpm -ql sudo
package sudo is not installed
[root@www sbin]#

nomb · 09-15-2010, 09:09 AM

If sudo is installed it should already be there as well. But visudo needs to be ran with root privileges. Which also means it should be in one of the sbins.

nomb

cnmoore · 09-15-2010, 02:04 PM

Do you suppose there is some good reason why our host has not installed sudo? I could ask them but I'm trying to avoid entering new ticket.

dcellis1950 · 09-15-2010, 02:30 PM

Add

PermitRootLogin no

to your ssh_config file.

If I remember correctly there was a keyword for this setting that allowed access via a key file, but denied password access to root. I think the keyword is without-password.

cnmoore · 09-15-2010, 02:32 PM

I don't dare do that - danger of blocking my hosts's techies. But I'm sure it is good advice.

Hangdog42 · 09-15-2010, 02:37 PM

Quote:

Originally Posted by cnmoore

Do you suppose there is some good reason why our host has not installed sudo? I could ask them but I'm trying to avoid entering new ticket.

None that I can think of other than they are trying to restrict who has root access. However, that is REALLY self-defeating as without sudo, someone is more likely to hand out the root password. Sudo was designed to prevent exactly that.

I'd ask for it to be installed. It just seems very wrong that it wasn't by default.

cnmoore · 09-15-2010, 07:00 PM

I hate to annoy our host. They give us a very special low monthly fee for our dedicated server, because the host's owner hates malware and because we are all volunteers and the forum has no income other than donations.

I'm marking this SOLVED because it's getting so long. In the future I will try to keep my threads more focused.

Hangdog42 · 09-16-2010, 07:12 AM

Quote:

I hate to annoy our host. They give us a very special low monthly fee for our dedicated server, because the host's owner hates malware and because we are all volunteers and the forum has no income other than donations.

I understand your reluctance to risk annoying someone who is giving you a good deal, but if your host hates malware, then they should understand the need for tools like sudo.