Disable SSH Root Login For Improved Security

This is a just a quick video on how to disable root login via SSH. Why disable the ability for to login via root? Because most attackers are going to try to get in as root.

REFERENCED:

WANT TO SUPPORT THE CHANNEL?

SOCIAL PLATFORMS:
💬 IRC: irc://freenode #distrotube

DT ON THE WEB:

FREE AND OPEN SOURCE SOFTWARE THAT I USE:

Your support is very much appreciated. Thanks, guys!

[CrustyAbsconder]

Hey distrohuggers.


Congratulations to the Rawhide Xfce team. Their huge update today works great. 1268 packages, with all the major components getting updates. However. My boot up time is about 3 minutes. Just a black screen. Kind of scary. But once in my Xfce session, things are butter-smooth with Mesa 20.0.0-rc2, and kernel 5.6.0-rc1, and systemd 245-rc1, etc. Wow ! I doubt any other distros have all that today. I doubt many of you have ever used Xfce on Rawhide. It is about as vanilla Xfce as you are going to find. But you get updates on almost a weekly basis of things, that generally do not get pushed in other distros until a new fixed version comes out. Anyways, in early May the upcoming release of Fedora Version 32 ( Xfce spin ), will be almost identical to this set-up on my box, with the main difference being, things that are not rc-versions will be stable and tested by dozens if not hundreds of Fedorans. Once version 32 is out in the wild for a while, things are going to get tweaked and it will be an awesome distro ( if you like the Fedora way of doing things, that is ). I will say this from experience. The Xfce spin of Fedora is like a totally different distro from their Workstation ( Gnome 3.34 ) version. The Xfce version requires more knowledge of Linux and the Fedora way of doing things. Most Linux users may not like that. Microsoft-transients would not have a clue what I am talking about, nor why.

[tc]

Great tip Derek, way to go for hardening the SSH daemon a bit. But why are people insisting on using :wq <enter> when hitting ZZ saves and quits vim in one sweep (you don't even need to hit enter!) and takes less than a split second?

[baskinlive]

Great video as always it was very informative. 👍 As a Linux newbie I thank you.

[AlucardNoir]

Disabling SSH for root on a server is advisable if you have access to the server itself, but I'm not so certain if you're renting the server - as most would be.

[Gabriel-mfwh]

3:06 what's this key "dubya"? I don't think I have it in my keyboard

[yakimura]

Man, you really looks like "slavic", lol

[midhunrajr]

On my desktop Arch, the value of allowrootlogin is 'prohibit-password'. I googled it and it says that option will not allow any root login with password. So in that case, do I need to change it to 'no'?

[FinaISpartan]

Disable networking for even better security

[TheShakeship]

What if the hackers watched this video?

[minepro]

After many days (and nights), I finished my arch installation (in which I had grub installed). I had everything (including eye-candy) set up. Today, grub failed. It turned out there was a filesystem error. After fsck, there was nothing left. I just wanted to share my pain 😞.

[johanb.]

Does not work because I can't scroll or page down in Xfce terminal!?

[jarilo]

>allowing SSH port to be open to the public and not running your own VPN

[elcugo]

You should probably disable sshd on your desktop machine: sudo systemctl disable sshd
Once disabled, you can temporarily start sshd when needed: sudo systemctl start sshd


Disabling sshd won't prevent you from using ssh to connect to other machines, so there is no downside to disabling sshd. You should only run sshd when you want to connect to your desktop from another machine.

[bhsecurity]

I use zerotier sd-wan (vpn) on my server and laptop. I set up to only allow connect from vpn subnet.

[jadowityherbatnik]

* The default for the sshd_config(5) PermitRootLogin option has
changed from "yes" to "prohibit-password".


* now bans all
interactive authentication methods, allowing only public-key,
hostbased and GSSAPI authentication (previously it permitted
keyboard-interactive and password-less authentication if those
were enabled).

[Khyree_Holmes]

My Linux Mint system says: "Prohibit-Password"

[syrefaen]

Its default off without having that line on Gentoo, but thanks my arch laptop where wrongly configured. Tested with commenting out the line, and now its not allowed. If I did use ssh on external IP I would use a certificate login, next video ? :p jk

[fire]

By default on Arch sshd_config have PermitRootLogin set to prohibit-password

[izzy]

Better option is too not have ssh open to the Internet.