17

The man page states that PermitRootLogin

Specifies whether root can log in using ssh(1).

However, it is not clear if this check is based on the user name ("root") or the UID (0).

What happens if the root account is renamed to "admin"? Will "admin" be able to log in when PermitRootLogin=no?

What happens if there are two accounts with UID=0, i.e. "root" and "admin"? Will either of them be able to login?

16

It seems the check is done on UID (tested on OpenSSH_6.7p1 Debian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016):

Set PermitRootLogin off:

mtak@pdv1:~$ grep PermitRootLogin /etc/ssh/sshd_config
PermitRootLogin no

Make sure a user named admin is created with UID 0:

mtak@pdv1:~$ sudo grep admin /etc/passwd
admin:x:0:0:Root User:/root:/bin/bash

Make sure the user can be used to log on to the system:

mtak@pdv1:~$ su - admin
Password: 
root@pdv1:~# 

Check if we can log on to the system using SSH:

mtak@rubiks:~$ ssh admin@pdv1
admin@pdv1's password: 
Permission denied, please try again.

If we turn PermitRootLogin on:

mtak@pdv1:~$ grep PermitRootLogin /etc/ssh/sshd_config
PermitRootLogin yes

And try to log on:

mtak@rubiks:~$ ssh admin@pdv1
admin@pdv1's password: 
Linux pdv1 4.4.8-1-pve #1 SMP Tue May 17 16:14:08 CEST 2016 x86_64
Last login: Wed Aug 24 12:05:28 2016 from xxx
root@pdv1:~# 
| improve this answer | |
  • Interesting that even though UID 0 has the username admin, it still shows up as root@pdv1 in the shell – Dezza Aug 25 '16 at 10:13
  • 1
    @Dezza Possibly depends on the order lines are listed in /etc/passwd (as in: find the first entry with UID=0). – TripeHound Aug 25 '16 at 12:00
19

I appreciate the approach of @mtak in the other answer, but the answer is obvious even without this trials.

It is based on the UID, as you can see in the source code of openssh:

if (authctxt->pw->pw_uid == 0 &&
            !auth_root_allowed(auth_method))
authenticated = 0;

Also every authentication method shows something like

if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
    ok = 0;

grep-ing further in the code, you may notice, there is no strcmp('root', pw->pw_name) or some alternative, if it will be enough for you.

| improve this answer | |
  • How do you know sshd checks for UID 0? You're not using any argumentation to support your statement. – mtak Aug 24 '16 at 14:19
  • 2
    Unix defines a superuser by its UID=0. As another example can be a source code of openssh. – Jakuje Aug 24 '16 at 14:24
  • The kernel does, but you were assuming OpenSSH did as well. For example, Apache basic authentication doesn't allow root login as well, does it? Thank you for the link, I've modified your answer to include that. – mtak Aug 24 '16 at 14:27
  • 1
    If it would do it some other way, it would be a potential security risk. – Jakuje Aug 24 '16 at 14:28
  • 3
    @Bakuriu and why it would create the pw context from something else. The openssh code is open source and interested readers can go through the whole code. Similar constructions are all over the code for every authentication method. If you grep through the code, you will never find strcmp('root', pw->pw_name), if it will make it more reliable for you. – Jakuje Aug 24 '16 at 15:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.