Mastering Linux Security and Hardening - Second Edition

Disabling root user login

A few years ago, there was a somewhat celebrated case where malicious actors had managed to plant malware on quite a few Linux servers somewhere in southeast Asia. There were three reasons that the bad guys found this so easy to do:

• The internet-facing servers involved were set up to use username/password authentication for SSH.
• The root user was allowed to log in through SSH.
• User passwords, including the root user's password, were incredibly weak.

All this meant that it was easy for Hail Mary to brute-force its way in.

Different distributions have different default settings for root user login. In the /etc/ssh/sshd_config file of your CentOS machine, you'll see this line:

#PermitRootLogin yes

Unlike what you ...