Red Hat System Administration I
The sshd daemon provides the OpenSSH service.
You can configure the service by editing the /etc/ssh/sshd_config file.
The default configuration of the OpenSSH server works well for many use cases.
However, you might want to make some changes to strengthen the security of your system.
You might want to prohibit direct remote login to the root account, and you might want to prohibit password-based authentication (in favor of SSH private key authentication).
It is a good practice to prohibit direct login to the root user account from remote systems.
Some risks of allowing direct login as the root user include the following cases:
The
rootusername exists on every Linux system by default, so a potential attacker needs only to guess the password, instead of a valid username and password combination. This scenario reduces complexity for an attacker.The
rootuser has unrestricted privileges, so its compromise can lead to maximum damage to the system.From an auditing perspective, it can be hard to track which authorized user logged in as the
rootuser and made changes. If users must log in as a regular user and switch to therootaccount, then you can view a log event for accountability.
Important
Starting in Red Hat Enterprise Linux 9, the PermitRootLogin parameter is set to the prohibit-password value by default.
This value enforces the use of key-based authentication instead of passwords for logging in as the root user, and reduces the risk of brute-force attacks.
The OpenSSH server uses the PermitRootLogin configuration setting in the /etc/ssh/sshd_config file to allow or prohibit users to log in to the system as the root user, as in the following example:
PermitRootLogin yes
If the PermitRootLogin parameter is set to the yes value, then anyone can log in as the root user remotely.
To prevent this situation, set the value to no.
Alternatively, to prevent password-based authentication but to allow private key-based authentication for root, set the PermitRootLogin parameter to without-password.
The SSH server (sshd) must be reloaded to apply any changes.
[root@host ~]# systemctl reload sshdAllowing only private key-based logins to the remote command line has advantages:
Attackers cannot use password-guessing attacks to remotely break into known accounts on the system.
With passphrase-protected private keys, an attacker needs both the passphrase and a copy of the private key. With passwords, an attacker needs only the password.
By using passphrase-protected private keys with
ssh-agent, the passphrase is entered and exposed less often, and logging in is more convenient for the user.
The OpenSSH server uses the PasswordAuthentication parameter in the /etc/ssh/sshd_config file to control whether users can use password-based authentication to log in to the system.
PasswordAuthentication yes
With the default value of yes for the PasswordAuthentication parameter in the /etc/ssh/sshd_config file, the SSH server allows users to use password-based authentication when logging in.
The value of no for PasswordAuthentication prevents users from using password-based authentication.
Whenever you change the /etc/ssh/sshd_config file, you must reload the sshd service to apply the changes.
Important
If you turn off password-based authentication for ssh, then you must ensure that the user's ~/.ssh/authorized_keys file on the remote server is populated with their public key, so that they can log in.
