Cannot SSH as root

Hi,

Edit /etc/sshd_config, find the line #PermitRootLogin yes and uncomment it, restart the service....

Well actually, i come from a *nix world - and this is how you do it there 😉
But it worth a shot..

Although i would never allow root to log in directly - look at sudo in stead - root login is a dangerous thing...

/Martin

A little hint - as root do this in terminal:

cd /etc
grep -i root `find . | grep -i ssh`

This looks for the text root in all the files in /etc which has the text ssh in the filename 🙂

/Martin

There are two ways to lock out root from direct SSH login. One is /etc/sshd_config and the other is service Limitations in ServerAdmin. The former simply will play "dumb" and not accept any password for root for ssh login. The latter will catch a little later in the process by refusing the authentication for root against Netinfo for the ssh service.

As mentioned before I'd NEVER allow direct SSH login by root. Not from the LAN, and especially not from the WAN. I'd even go as far as changing the default ssh port from 22 to something obscure. (Which sadly isn't easy with 10.4 and launchd)

I actually only know a single thing where you need direct ssh root login and that is to set up an OD replica. Once that is established, you can disable root ssh login again.
MacLemon

Hi MacLemon,

There also a nice saying "Security by obscurity". In the hope this will not be a long political discussion 🙂 i will try to give an alternative..

Use the firewall and block ssh traffic from all unknown IP adresses - a much nicer solution.

And even if i know i's only a few years back since the last hole in SSH was discovered, i would say that this is one of the more secure protocols to hold open for all traffic on the public network. I could find other protocols that i would rarther shut down...

/Martin

I didn't mean to refer to "security by obscurity". Blocking outside ssh access from all unknown IPs sometimes is not feasable. For example if you frequently need to access a machine from varying customers whose IP ranges you cannot predict.

By changing the ssh port you can at least reduce the lines for bad login attempts that are generated at an increasing rate by automated scripts that usually don't bother to scan for open ports and then try to find an ssh server on a non-standard port.

Of course with an auditing tool like Nessus you can find the port and service. I totally agree. It's just that most automated attacks target standard ports and in that case moving to an obscure port will give you a lot more silence in your secure.log.

Of course a really good password or public key authentication will further help to increase security. (In my case public key auth is not possible either, since I need to access from my varying customer's machines.)
MacLemon

Just out of curiosity: What applications do you use that use ssh and cannot have their port changed?
MacLemon

I'd never condone allowing root access via ssh, but if you have to turn it on, do yourself a favor and install denyhosts (http://denyhosts.sourceforge.net), which automatically blocks an IP address after a configurable number of failed login attempts.