858
I didn't know you were supposed to disable root user... (linux.community)
submitted 2 years ago by to c/linuxmemes@lemmy.world
170 comments fedilink hide all child comments
 

Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.

Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.

Rolled back to the backup before I made it public and now I have a security checklist.

you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 2 years ago (1 child)

Just turn off password logins from anything but console. For all users. No matter where it runs.

It becomes second to nature pretty fast, but you should have a system for storing / rotating keys.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 years ago* (2 children)

    How do I whitelist password logins? I only disabled password logins in SSHd and set it to only use a key.

    I also like to disable root login by setting its default shell to nologin, that way, it's only accessible via sudo or doas. I think there's a better way of doing it, which is how Debian does it by default when not setting a root password, but I'm not sure how to configure that manually, or even what they do.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 2 years ago

    Right - so console/tty login is restricted by pam and its settings. So disabling ssh root logins means you can still log in as root there.

    To lock root you can use passwd -l

    If locking root I would keep root shell so i could sudo to root.

    So my normal setup would be to create my admin user with sudo rights, set «PasswordAuthentication no» in sshd config and lock root with «sudo passwd -l root» Remember to add a pubkey to admin users authorizedkeys, and give it a secure but typable password

    My root is now only available through sudo, and i can use password on console. Instead of locking root you can give it secure typable password. This way root can log in from console so you dont need sudo for root access from console.

    It boils down to what you like and what risks you take compared to usable system. You can always recover a locked root account if you have access to single-user-mode or a live cd . Disk encryption makes livecd a difficult option.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 2 years ago*

    To whitelist password logins in ssh you can match username and give them yes after you set no (for all). But i see no reason for password logons in ssh, console is safe enough (for me).

  • permalink
  • fedilink
  • source
  • parent