ssh access allowed only to root user?

zovres · 09-25-2003, 09:46 AM

I know I can give ssh permission to a specific ip or range of ip, but is it possible to give it to a specific user?

I my case I would like only root to be able to connect via ssh

thx

unSpawn · 09-25-2003, 10:21 AM

Yes you can (man sshd_config, see the AllowUsers/AllowGroups directive), and no you must not do that: use an unprivileged login to get to the box and then use sudo to su to the root account.

zovres · 09-25-2003, 10:43 AM

man sshd_config, great

thx

why shouldn't I do that? I mean, usually I ssh to config my computer so I do it using root.
oh I get it, it will transfert the root password via the internet....
ok I'll allow my user then... but if I su to root I will be required to enter the password anyway, so what is the difference?

great advice thx unSpawn

unSpawn · 09-25-2003, 12:28 PM

oh I get it, it will transfert the root password via the internet.
Yes, but sniffing sshv2 isn't "trivial", it is just best practice to never let root do anything directly on a remote box.

but if I su to root I will be required to enter the password anyway
That's why I said "use sudo to su to the root account" because then you can use the users password instead. If you only need to do a few things as root then it's also best to set up commands for that in sudo, else if you really need a root shell, make sure you export a reasonable timout for the shell. And I don't have to tell you about good vs bad passwds, do I? :-]

zovres · 09-25-2003, 01:09 PM

hey thx man that makes complete sense

always good to have security tips like these

fatgod · 09-25-2003, 04:19 PM

Dude, you should know, you probably already do but hey

, ssh encrypts all traffic involved in the connection before it asks for the password. And if you really want security check out RSA or DSA key authentication. It rocks no more passwords transfered at all, just "ssh remotehost" and your given a prompt on the box. great stuff

It's explained in full, like only IBM know how

here...

http://www-106.ibm.com/developerwork...ry/l-keyc.html