DEV Community

Janak Shrestha
Janak Shrestha

Posted on

Secure Root SSH Access

#linux

Following security audits, the xFusionCorp Industries security team has rolled out new protocols, including the restriction of direct root SSH login.

Your task is to disable direct SSH root login on all app servers within the Stratos Datacenter.

Solution

Step 1: Connect to Each App Server and Configure SSH

You need to modify the SSH configuration file (/etc/ssh/sshd_config) on all three App servers.

App Server 1 (stapp01) - User: tony 

ssh tony@stapp01
# Password: Ir0nM@n
Enter fullscreen mode Exit fullscreen mode

App Server 2 (stapp02) - User: steve 

ssh steve@stapp02
# Password: Am3ric@
Enter fullscreen mode Exit fullscreen mode

App Server 3 (stapp03) - User: banner 

ssh banner@stapp03
# Password: BigGr33n
Enter fullscreen mode Exit fullscreen mode

Step 2: Configure SSH to Disable Root Login

On each server, perform these steps:

# Switch to root
sudo su -
# Enter the user's password

# Edit the SSH configuration file
vi /etc/ssh/sshd_config
# Or use nano if available
nano /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Find and modify the following line:

# Change from:
#PermitRootLogin yes
# or
PermitRootLogin yes

# To:
PermitRootLogin no
Enter fullscreen mode Exit fullscreen mode

Alternative: If the line doesn't exist, add it:

echo "PermitRootLogin no" >> /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Step 3: Restart SSH Service

After making the change, restart the SSH service:

# For RHEL/CentOS 7+
systemctl restart sshd

# Or if using service command
service sshd restart

# Verify SSH service is running
systemctl status sshd
Enter fullscreen mode Exit fullscreen mode

Complete One-Line Commands

App Server 1 (stapp01): 

echo 'Ir0nM@n' | ssh tony@stapp01 "sudo -S bash -c 'sed -i \"s/^#PermitRootLogin yes/PermitRootLogin no/\" /etc/ssh/sshd_config; sed -i \"s/^PermitRootLogin yes/PermitRootLogin no/\" /etc/ssh/sshd_config; grep -q \"^PermitRootLogin no\" /etc/ssh/sshd_config || echo \"PermitRootLogin no\" >> /etc/ssh/sshd_config; systemctl restart sshd; echo \"SSH root login disabled successfully\"'"
Enter fullscreen mode Exit fullscreen mode

App Server 2 (stapp02): 

echo 'Am3ric@' | ssh steve@stapp02 "sudo -S bash -c 'sed -i \"s/^#PermitRootLogin yes/PermitRootLogin no/\" /etc/ssh/sshd_config; sed -i \"s/^PermitRootLogin yes/PermitRootLogin no/\" /etc/ssh/sshd_config; grep -q \"^PermitRootLogin no\" /etc/ssh/sshd_config || echo \"PermitRootLogin no\" >> /etc/ssh/sshd_config; systemctl restart sshd; echo \"SSH root login disabled successfully\"'"
Enter fullscreen mode Exit fullscreen mode

App Server 3 (stapp03): 

echo 'BigGr33n' | ssh banner@stapp03 "sudo -S bash -c 'sed -i \"s/^#PermitRootLogin yes/PermitRootLogin no/\" /etc/ssh/sshd_config; sed -i \"s/^PermitRootLogin yes/PermitRootLogin no/\" /etc/ssh/sshd_config; grep -q \"^PermitRootLogin no\" /etc/ssh/sshd_config || echo \"PermitRootLogin no\" >> /etc/ssh/sshd_config; systemctl restart sshd; echo \"SSH root login disabled successfully\"'"
Enter fullscreen mode Exit fullscreen mode

Step-by-Step Interactive Commands

For each App Server: 

# Connect to the server
ssh tony@stapp01  # or steve@stapp02 / banner@stapp03
# Enter password

# Become root
sudo su -
# Enter password

# Backup SSH configuration (recommended)
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

# Edit SSH configuration
vi /etc/ssh/sshd_config

# Find the line: #PermitRootLogin yes or PermitRootLogin yes
# Change it to: PermitRootLogin no
# Save and exit (:wq in vi)

# Verify the change
grep "^PermitRootLogin" /etc/ssh/sshd_config
# Should output: PermitRootLogin no

# Restart SSH service
systemctl restart sshd

# Verify SSH service is running
systemctl status sshd

# Test that root login is disabled (optional)
ssh root@localhost
# Should show: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password)

# Exit back
exit
exit
Enter fullscreen mode Exit fullscreen mode

Automated Script (Run from Jump Host)

Create a script file disable_root_ssh.sh:

#!/bin/bash

# Define servers with their credentials
declare -A SERVERS=(
    ["stapp01"]="tony:Ir0nM@n"
    ["stapp02"]="steve:Am3ric@"
    ["stapp03"]="banner:BigGr33n"
)

for server in "${!SERVERS[@]}"; do
    IFS=':' read -r user pass <<< "${SERVERS[$server]}"
    echo "========================================="
    echo "Disabling root SSH login on $server"
    echo "========================================="

    sshpass -p "$pass" ssh -o StrictHostKeyChecking=no $user@$server "sudo -S bash -c '
        echo \"Backing up SSH config...\"
        cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup.\$(date +%Y%m%d_%H%M%S)

        echo \"Disabling root login...\"
        # Remove any existing PermitRootLogin lines
        sed -i \"/^PermitRootLogin/d\" /etc/ssh/sshd_config
        # Add the new setting
        echo \"PermitRootLogin no\" >> /etc/ssh/sshd_config

        echo \"Verifying configuration...\"
        grep \"^PermitRootLogin\" /etc/ssh/sshd_config

        echo \"Restarting SSH service...\"
        systemctl restart sshd

        echo \"✓ Root SSH login disabled successfully on $server\"
    '"
    echo ""
done

echo "✅ Completed disabling root SSH login on all App servers!"
Enter fullscreen mode Exit fullscreen mode

Make it executable and run:

chmod +x disable_root_ssh.sh
./disable_root_ssh.sh
Enter fullscreen mode Exit fullscreen mode

Verification Commands

On each server, verify the configuration: 

# 1. Check SSH configuration
grep "^PermitRootLogin" /etc/ssh/sshd_config
# Should output: PermitRootLogin no

# 2. Check if any other PermitRootLogin lines exist
grep -i "permitrootlogin" /etc/ssh/sshd_config
# Should only show: PermitRootLogin no

# 3. Check SSH service status
systemctl status sshd

# 4. Test root login (should fail)
ssh root@localhost
# Should show: Permission denied

# 5. Check listening port and service
netstat -tlnp | grep sshd
ss -tlnp | grep sshd

# 6. Check SSH logs for any issues
tail -f /var/log/secure  # RHEL/CentOS
# or
tail -f /var/log/auth.log  # Ubuntu/Debian
Enter fullscreen mode Exit fullscreen mode

Quick Verification Script 

#!/bin/bash
# verify_root_login.sh

for server in stapp01 stapp02 stapp03; do
    echo "=== $server ==="
    ssh tony@$server "sudo grep '^PermitRootLogin' /etc/ssh/sshd_config" 2>/dev/null || \
    ssh steve@$server "sudo grep '^PermitRootLogin' /etc/ssh/sshd_config" 2>/dev/null || \
    ssh banner@$server "sudo grep '^PermitRootLogin' /etc/ssh/sshd_config" 2>/dev/null
    echo ""
done
Enter fullscreen mode Exit fullscreen mode

Alternative Methods

Method 1: Using sed to modify the file 

# Disable root login
sudo sed -i 's/^#PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config

# If no line exists, add it
grep -q "^PermitRootLogin" /etc/ssh/sshd_config || echo "PermitRootLogin no" >> /etc/ssh/sshd_config

# Restart SSH
sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Method 2: Using echo to append (if line doesn't exist) 

# Remove any existing PermitRootLogin lines
sudo sed -i '/^PermitRootLogin/d' /etc/ssh/sshd_config

# Add new setting
echo "PermitRootLogin no" | sudo tee -a /etc/ssh/sshd_config

# Restart SSH
sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Method 3: Using a configuration file 

# Create a drop-in directory (if supported)
sudo mkdir -p /etc/ssh/sshd_config.d/
echo "PermitRootLogin no" | sudo tee /etc/ssh/sshd_config.d/disable-root.conf

# Restart SSH
sudo systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode

Security Best Practices

After disabling root SSH login, consider these additional security measures:

  1. Enable key-based authentication only: 
   sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode
  1. Change SSH port (optional): 
   sudo sed -i 's/^#Port 22/Port 2222/' /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode
  1. Limit user access: 
   echo "AllowUsers tony steve banner" >> /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode
  1. Enable logging: 
   echo "LogLevel VERBOSE" >> /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode

Troubleshooting

  1. "Permission denied": Ensure you have sudo access 
   sudo -l  # Check sudo privileges
Enter fullscreen mode Exit fullscreen mode
  1. "sed: -e expression #1": Check syntax of sed command 
   # Use double quotes properly
   sed -i "s/^#PermitRootLogin yes/PermitRootLogin no/" /etc/ssh/sshd_config
Enter fullscreen mode Exit fullscreen mode
  1. SSH service fails to restart: Check configuration syntax 
   sshd -t  # Test configuration
   # If error, restore backup
   cp /etc/ssh/sshd_config.backup /etc/ssh/sshd_config
   systemctl restart sshd
Enter fullscreen mode Exit fullscreen mode
  1. Can't connect after change: Always keep an active session open while testing 
   # Open two sessions: one for changes, one for testing
   # This prevents lockout if configuration has issues
Enter fullscreen mode Exit fullscreen mode

Expected Output 

[root@stapp01 ~]# grep "^PermitRootLogin" /etc/ssh/sshd_config
PermitRootLogin no
[root@stapp01 ~]# systemctl status sshd
● sshd.service - OpenSSH server daemon
   Loaded: loaded (/usr/lib/systemd/system/sshd.service; enabled; vendor preset: enabled)
   Active: active (running) since [date]
   ...
[root@stapp01 ~]# ssh root@localhost
root@localhost's password: 
Permission denied, please try again.
Enter fullscreen mode Exit fullscreen mode

Complete Solution Summary

Direct SSH root login has been disabled on all App servers:

  • ✅ stapp01: Modified /etc/ssh/sshd_config, set PermitRootLogin no
  • ✅ stapp02: Modified /etc/ssh/sshd_config, set PermitRootLogin no
  • ✅ stapp03: Modified /etc/ssh/sshd_config, set PermitRootLogin no
  • ✅ SSH service restarted on all servers
  • ✅ Configuration verified on all servers
  • ✅ Root login attempts will be rejected

This security protocol ensures that direct root access via SSH is no longer permitted, aligning with xFusionCorp Industries' new security policies.

Top comments (0)