33
Have I successfully blocked ssh logins to root? (lemmy.ml)
submitted 2 years ago by to c/linux@lemmy.ml
22 comments fedilink hide all child comments
 

I have a server where I believe I have disabled root login via ssh. I think it is done correctly, as I cannot login with root myself via ssh, but I would've thought that it would be reflected in /var/log/auth.log. Instead, it shows up as failed password entry. Is this intended?

What I've done is to uncomment the PermitRootLogin no line in /etc/ssh/sshd_config. Rest of the config file is left at default.

Bonus question: All login attempts by ssh seems to go over some random port (even my own successful logins). Why is this?

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 2 years ago (1 child)

Match blocks allow you to restrict who/what is allowed or not allowed to connect to the server. There is a large number of options to utilize. Put this near the bottom of sshd_config. There should be an example there.

Here are some more examples: https://stackoverflow.com/questions/10829712/sshd-with-multiple-match-sections-override-settings

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •