up vote 3 down vote favorite
share [g+] share [fb]

I am pondering on what would be any implications in logging in via SSH as root?

Surely SSH is safe or am I kidding myself and falling for the unwary ethic of logging into a remote Linux box as root?

Edit: Ok, I discovered some open ports remotely on the linux box, and decided to login as root to edit a configuration file to shut off the ports, hence my questioning in whether logging in as root...another point, since SSH is 'supposedly secure', there should not be any implications or am I kidding myself!??? Would it be better to login as normal user then su from there?

Ok, to make things even more interesting, what if its a bog standard generic linux distribution with no suid programs etc, then what happens...take that out of the picture, and say, for editing a configuration file...hackers are not going to see that are they, otherwise by the sound of the answers, it is putting an impression that hackers can see the traffic the minute you login as root?! Otherwise why bother using SSH?

I mean, surely, SSH was designed to replace telnet and thereby increase protection...as we all know back in the early 90's before the internet became publicly available, that there was indeed sysadmins dialing in to private networks or telnet'ting into a remote system as root....

Thanks.

link|improve this question
2  
Everyone knows that you are not supposed to use root priviledges if not necessary. But explaining exactly why will be an interesting point. – Arko Mar 25 '10 at 16:46
feedback

5 Answers

up vote 10 down vote

sudo is there for a reason. It's to protect you from yourself.

There is no "known harm" per se, however there can be unintended consequences. For example, creating files will leave them with root as a creator. Other users may not be able to access / run them because they don't have the privilege to do so.

It would be much better to login as normal and then su or sudo for root level access on an as needed basis.

Running programs while logged in as root will give them root privileges. You don't want every program running as root and able to access anything. Logging in as root also gives way to malicious programs that you don't intentionally run. If you were to say run an innocent program that has been edited to do something stupid like rm -rf / it won't normally be able to. If you're running as root it will though.

link|improve this answer
feedback
up vote 7 down vote

Whichever program you execute while being root has root's privileges. If any of those programs has a security hole, an attacker could get root privileges this way.

By not allowing root to login via SSH, an attacker would have to find out a normal user's password first and then get root access somehow. It's a bit more difficult than allowing the root account to be accessed directly.

link|improve this answer
1  
If the user's password they have is in the sudoers it doesn't really matter. – Josh K Mar 25 '10 at 17:47
2  
They would have to guess a valid username though ... not as easy as trying to log-in as root brute-force. – honk Mar 25 '10 at 17:51
Tangent - code formatting on root? Really? Seems a tad excessive. – mindless.panda Mar 25 '10 at 19:15
@Josh Thanks for fixing the language; I was in a bit of a hurry and didn't notice that. – foraidt Mar 25 '10 at 21:33
@mxp: No problem. @honk: We're assuming that they sniffed the username off of a local network or something. I can setup wireshark while connected to just about anything and read anything that's transmitted in plain text. FTP details too, so if your SSH password is the same as your FTP password.... :) – Josh K Mar 26 '10 at 3:01
show 1 more comment
feedback
up vote 4 down vote

To put it plainly: There is no more harm in logging in as root via SSH as there is in logging in as root locally.

link|improve this answer
good point! :) +1 from me! – t0mm13b Mar 25 '10 at 18:11
feedback
up vote 1 down vote

In addition to MXPs answer, if you run as root you risk damaging your system yourself, forget hackers.

link|improve this answer
@Moshe: what if you are an experienced user and have gone through the rites of passage under unix.... – t0mm13b Mar 25 '10 at 16:54
2  
@tommieb75 - experienced users are still human, they make mistakes, too. – Gnoupi Mar 25 '10 at 17:03
@tommie even experienced users make mistakes. We're only human. serverfault.com/questions/5066/biggest-command-line-mistake – John T Mar 25 '10 at 17:03
@John - experienced users use telepathy, though, obviously. – Gnoupi Mar 25 '10 at 17:09
@gnoupi - exactly. – Moshe Mar 25 '10 at 17:18
feedback
up vote 1 down vote

There's a bunch of questions about this on SF. It boils down to two things IMO - in many internet facing systems there's brute force attacks, revolving around trying to get into the root account, so turning off root logons is not a bad idea.

In addition if something you are running as root gets exploited, your computer could get hacked- using a user account mitigates the damage somewhat.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.