How to disallow user to login as root?

your_shadow03 · 10-12-2009, 02:17 AM

I want to disallow root login on my RHEL Machine?
How can I make it possible?

lutusp · 10-12-2009, 02:28 AM

Quote:

Originally Posted by your_shadow03

I want to disallow root login on my RHEL Machine?
How can I make it possible?

Change root passwords and don't tell the user the new password. This is the usual way to accomplish that objective.

your_shadow03 · 10-12-2009, 02:38 AM

Thats Funny Answer..
Jokes Apart..

I need answer from Linux Freakers..
I need to disallow user to login as root.

Any idea?

smeezekitty · 10-12-2009, 02:58 AM

jmc1987 · 10-12-2009, 02:59 AM

Quote:

Originally Posted by your_shadow03

Thats Funny Answer..
Jokes Apart..

I need answer from Linux Freakers..
I need to disallow user to login as root.

Any idea?

Like do you mean stop the users from using the

Code:

$ su
(enter root password on prompt)'

Or are you trying to set it up where a user can access to certain root areas? You can use sudo for that.

Or if the users keep going into root with su command and you don't want them to have no root level access at out. Simply change root password and keep it a secret.

Other than that you need to post more information of what you really want because I don't think any body is going to understand "I need answers from Linux Freakers.."

~sHyLoCk~ · 10-12-2009, 03:03 AM

Quote:

Originally Posted by your_shadow03

I want to disallow root login on my RHEL Machine?
How can I make it possible?

Try this.

avijitp · 10-12-2009, 03:12 AM

In the /etc/ssh/sshd_conf set

Code:

PermitRootLogin No

Refresh sshd to re-read this new configuration. This will stop direct root login to the box. You need to login as regular user and then then su to root.

r3sistance · 10-12-2009, 04:32 AM

There is one part of the question there is no information on, are you trying to disable root logins completely, from SSH or at console? And this can only be to direct root logins, someone has to have an account that can sudo or something else you are locking yourself out and in the end at console an experienced enough user could easily by pass most possible ways of disabling root.

your_shadow03 · 10-12-2009, 05:48 AM

Sorry Guys if the question went little short.
I was looking for something which avijitp jotted.
One thing to ask you all:

Say i put PermitRootLogin No in sshd_config.
and user logged in through su.
Now he can run root-leel commands?
Why it is considered safe?
Doesnt all root commands run thru that?

avijitp · 10-12-2009, 05:53 AM

Quote:

Say i put PermitRootLogin No in sshd_config.
and user logged in through su.
Now he can run root-leel commands?
Why it is considered safe?
Doesnt all root commands run thru that?

A user can become root with the help of su only if he knows the root password unless you decide to configure sudo to allow the users to gain root privileges without password.

So it effectively allows A user to run root level commands only if he knows the root password. Disabling direct root ssh login is often considered to be a good practice to protect the system from Bruteforce attacked which can exploit a week root password.

Hope this helps.

your_shadow03 · 10-12-2009, 05:56 AM

Thats mean if I login through su as root(I have root credentials !!!) so I can run any number of commands which a root uses Right?

avijitp · 10-12-2009, 05:59 AM

Right!

your_shadow03 · 10-12-2009, 06:06 AM

My Next Question:
Can I completely disable root access?

avijitp · 10-12-2009, 06:16 AM

Quote:

My Next Question:
Can I completely disable root access?

Why on the earth would you do that? You plan to install a system and plan not to maintain that? Someone responsible should have a super user (root) privileges.

Wim Sturkenboom · 10-12-2009, 06:23 AM

Quote:

Originally Posted by your_shadow03

Thats Funny Answer..
Jokes Apart..

I need answer from Linux Freakers..
I need to disallow user to login as root.

Any idea?

That's not a joke, that is serious and it's true. If you're stupid enough to give tha password away, you can not prevent it by normal means.

Quote:

Originally Posted by your_shadow03

My Next Question:
Can I completely disable root access?

yes, check the -l (lowercase L) option of the passwd command

But I don't advise it for the root user as it is PERMANENT. You need root privileges to reverse it but can't gain those privileges as the account is locked.

The question that you have not answered yet is why you want this?