Re: SSH as root

On Thu, Jul 03, 2003 at 10:20:42AM -0700, Paul Bauer wrote:
> I personally don't allow ssh as root but am now curious as to why this

My personal opinion on this, is that "ssh as root" is not descriptive enough. I believe that the authentication methods root is allowed to use are also important.

In my experience, a happy combination of security and usability is provided in setting things up as follows:

• allowing remote root logins only with ssh keys
• allowing root to login on the console with a password
• making individual root accounts for users. this simplifies shell choices and startup scripts. however.. these accounts have no password, and use ssh keys instead. I also give unique groups here. this has proven handy to tell who made some mysterious file called do_not_delete.txt . You can see the file is owned by root:joeroot so you know it's joe's file, and you can go ask him if it can be deleted now.