Hi there,

I want to disable any root login via ssh except from my admin servers. So I screwed around with AllowUsers and Denyusers parameters in sshd_config using something like this:

AllowUsers root@host1 root@host2 *@*
DenyUsers root

Unfortunately only the Deny rule seems to take effect. In my opinion these roules are more or less useless without the capability to combine these 2 rules. Don´t you think?

Cheers
Holger

In your sshd config file put:

PermitRootLogin no
AllowUsers your_user_name

No need to use the Deny thingie.
This is for the pc's that you don't want root to login.

You could also use this for you servers, create a normal account for yourself and allow that account and then su to root to do your stuff

Hi nukey,

this way, it doesn´t really work. When I would set PermitRootLogin to no, I wouldn´t be able to log in as root from the admin hosts even if they had rsa-key authentication.

The AllowUsers list must have some sort of wildcard, since I have no idea who needs logins on which machines (we´re talking about aprox. 150 Servers and allmost 2000 users).

We´re also thinking of some sort of process for login as unprivelidged user --> sudo something --> so on, but this solution is thought bo be a quick fix...


Thanks for your comment anyway.

Ok, but don't you agree that you don't have to be able to login as root. If you have access to a specific server with a specific username you could always su to root.

Anyways, I searched google and found this:

I found it here

Also take a look here