ServerBuddies Support Blog

Disabling Root Using PAM

PAM, through the /lib/security/pam_listfile.so module, allows great flexibility in denying specific accounts.

This allows the administrator to point the module at a list of users who are not allowed to log in.

Below is an example of how the module is used for the vsftpd FTP server in the /etc/pam.d/vsftpd PAM configuration file (the \ character at the end of the first line in the following example is not necessary if the directive is on one line):

This tells PAM to consult the file /etc/vsftpd.ftpusers and deny access to the service for any user listed. The administrator is free to change the name of this file, and can keep separate lists for each service or use one central list to deny access to multiple services.

Limiting Root Access

Rather than completely deny access to the root user, the administrator may want to allow ac-cess only via setuid programs, such as su or sudo.

Upon typing the su command, the user is prompted for the root password and, after authentica-tion, is given a root shell prompt.

Once logged in via the su command, the user is the root user and has absolute administrative access to the system. In addition, once a user has become root, it is possible for them to use the su command to change to any other user on the system without being prompted for a password.

Because this program is so powerful, administrators within an organization may wish to limit who has access to the command.

One of the simplest ways to do this is to add users to the special administrative group called wheel. To do this, type the following command as root:

In the previous command, replace with the username you want to add to the wheel group.

You can also try using the command prompt for this, type the command system-config-users at a shell prompt.

Select the Users tab, select the user from the user list, and click Properties from the button menu (or choose File => Properties from the pull-down menu).

Then select the Groups tab and click on the wheel group.

Next, open the PAM configuration file for su (/etc/pam.d/su) in a text editor and remove the comment # from the following line:

Doing this permits only members of the administrative group wheel to use the program.

Methods of Disabling the Root Account.

Changing the root shell.

To prevent users from logging in directly as root, the system administrator can set the root ac-count’s shell to /sbin/nologin in the /etc/passwd file.

Edit the /etc/passwd file and change the shell from /bin/bash to /sbin/nologin.

The following programs are prevented from ac-cessing the root account:

Programs that do not re-quire a shell, such as FTP clients, mail clients, and many setuid programs. The following programs are not prevented from accessing the root ac-count:

Disabling root ac-cess via any con-sole device (tty).

An empty /etc/securetty file prevents root login on any devices attached to the computer.

Disabling root SSH Login.

Edit the /etc/ssh/sshd_config file, and set the PermitRootLo-gin parameter to no.

to

Use PAM to limit root access to services.

Edit the file for the target service in the /etc/pam.d/ directory. Make sure the pam_listfile.so is re-quired for authentication.

How to disable direct root login

Direct login for the root user is a major security issue. We can disable direct login access to reduce the security risk. This way we can have two separate passwords for root access which makes the box more secure. Also we are using the protocol 2 which is newer and more secure.

1. SSH into your server as ‘admin’ and gain root access by su

2. Copy and paste this line to edit the file for SSH logins

3. Find the line

4. Uncomment it and change it to look like

5. Next, find the line

6. Uncomment it and make it look like PermitRootLogin no

7. Save the file Ctrl+X then Y then enter

8. Now you can restart SSH

Now, no one will be able to login to root with out first loggin in as admin and ’su -’ to root.

Be sure that you remember both the passwords!

Disable Root Logins

SSH server settings are stored in the /etc/ssh/sshd_config file. To disable root logins, make sure you have the following entry:

and restart the sshd service:

If you need root access, login as a normal user and use the su command.