Home / server / Questions / 521530
In Process
Mickey Shine
Asked: 2013-07-08 23:57:26 +0800 CST

Is it necessary to disable root account on linux servers?

  • 772

I am planning to deploy some CentOS linux servers and I've read many articles that suggested to disabled root account. I am just wondering is that necessary? If not, what's the best security policy?

linux

3 Answers

  1. I wouldn't disable root, but I would disable root logins via ssh.

    I'd still allow root login on the console, because if you have problems that might be the only way in short of booting from soem other media, mounting your root partition, re-enabling root - you get the idea.

    • 3

  2. What I usually do is create another account, with the possibility to access the root, and disable the SSH root account, because any hacker can try to access your server, and brute force your PW.

    Edit: It's also nice, to set MaxAuthTries 6 or 10, or whatever, in sshd_config

    • 1

  3. The main reason behind that advise is security. root is an already known username so the password is only thing required for remote login. Other common usernames are usually disabled for remote login already.

    If an attacker wants to break your server, he first needs to guess the username, and then try to guess the password for that username, so the more common dictionary attacks are done to the root password, there are two reasons to do it that way.

    From my point of view the most pragmatic approach is disabling password authentication for root.

    PermitRootLogin without-password

    Only root login with public key authentication will be allowed. Limiting MaxAuthTries is a good idea also.

    • 1