Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

EDIT

Read answer of janos below.

It's more use SSH-keys to access a root directly.


I want to secure the SSH access to my server. One thing I read everywhere is to disable the root user login.

To still have access via SSH I created another user via sudo adduser john

How can I still do root things with this account?

sudo command asks for a password of the user but gives john not in sudoer file. Action will be reported. When I use su I log in as root which I'm going to disable.

How can I stil do root things with the normal account john?

share|improve this question

4 Answers 4

up vote 2 down vote accepted

You should edit /etc/sudoers using the visudo command and add a line for the user john.

Probably you will want to add a line like john ALL=(ALL) ALL. Then you can issue commands using sudo (running as john) and, if desired, disable the root user, or at least use a very strong password for it - this would be my choice.

Besides, most versions of SSH should have root login disabled by default; that means you can't login as root over SSH, but you can SSH as user and then become root with su. If in doubt, check the PermitRootLogin statement in the /etc/ssh/sshd_config file. From the manpage:

   PermitRootLogin
          Specifies whether root can log in using  ssh(1).   The  argument  must  be
          ``yes'',  ``without-password'',  ``forced-commands-only'', or ``no''.  The
          default is ``yes''.
share|improve this answer
1  
At least Debian systems allow root login per default. If you comment the PermitRootLogin yes line, root login will be enabled. –  speakr Jun 15 '12 at 21:58
    
Indeed. Fixing my answer –  Renan Jun 15 '12 at 22:00

Disable root login via ssh is smart. But there is no reason not to su to root once you login. Make sure both accounts have strong passwords and install fail2ban to prevent forest fires - sorry, crack attempts.

share|improve this answer
    
But when I disable root login via SSH I cannot use #su? Or am I wrong? If I can do #su with root access disabled than i don't have a problem. –  OrangeTux Jun 15 '12 at 21:50
1  
You can still use su. Disabling ssh login for root has no effect on becoming root with su after a successful ssh login as normal user. –  speakr Jun 15 '12 at 21:55
    
You are wrong; you can't login as root, but you can login as user and become root using su. –  Renan Jun 15 '12 at 21:55
  • If you're already logged in as root, using sudo is pointless.

  • To allow john to gain root privileges, it suffices to execute

    usermod john -G admin
    

    in a Ubuntu default installation, since it adds john to the group admin (implies root privileges).

    For other distributions, you can consult /etc/sudoers for a group with this privilege.

  • Disabling root is nice, but a user with root privileges can still do anything he wants.

    Not logging in as root only has advantages if you do it for any of the following reasons:

    • Preventing accidental changes to your system (rm -rf /, malware, etc.).

      sudo su lets you become root once you logged in as a user with root privileges.

    • You use something else than the user password to authenticate (e.g., private keys).

      In this case, the sudo command still requires the user password, so it adds an extra layer of security (unattended laptop, etc.).

share|improve this answer

It is worth noting that permitting root login with ssh is less insecure than the practice of using su root. This post on the Debian mailing list by Simon Kirby explains it very well:

http://lists.debian.org/debian-security/2002/06/msg00418.html

Permitting root login with ssh keys only might be more secure than the practice of sudo, but I'm not an expert. For what it's worth, the setting for that is:

PermitRootLogin without-password
share|improve this answer
    
It's not an answer on my question. The problem I described is not an issue anymore. Ty –  OrangeTux Jun 23 '12 at 8:57
    
You should mark @Renan's answer as "the answer". My "answer" was meant as additional important note. –  janos Jun 23 '12 at 9:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.