Allowing the root user to login directly can be a major security issue. Here, i\u2019ll show you how to disable it so you can still login as root but just not directly, reducing the security risk. This will force an attacker to guess 2 separate passwords to gain root access. <\/p>\n
You will first need to login as your root user in SSH. We will be forcing the use of SSH protocol 2, which is a newer, more secure SSH protocol. If you\u2019re using cPanel make sure you add your admin user to the \u2018wheel\u2019 group so that you will be able to \u2019su -\u2019 to root, otherwise you may lock yourself out of root.<\/p>\n
1. SSH into your server as \u2018root\u2019. Now, let’s create a user and add it to the wheel group. For example. we want to create a user admin and give him su privileges.<\/p>\n
SSH into your server as root and follow the below commands to create a user. now, lets add a password to the account \/\/ You can replace admin with any username of your choice.<\/p>\n Next, add user to wheel group. Use your browser to login to your WHM panel and go to Main >> Security Center >> Manage Wheel Group Users<\/p>\n You will see “Added user admin to the wheel group” Now, click on “Manage Wheel Group Users” again and it will return you to the Manage Wheel Group Users section.<\/p>\n You will see there; Users Currently in the wheel group “root,admin” Note: This group controls which users can use the system’s `su` utility.<\/p>\n You have successfully added a user to the ‘wheel’ group who will be able to ‘su -‘ to root.<\/p>\n Before we disable root login, let us check if the user can login and su \u2013 to gain root privileges.<\/p>\n SSH into your server as ‘admin’ You have successfully logged in and have root privileges. Now let us disable root login.<\/p>\n 2. Copy and paste this line to edit the file for SSH logins 3. Find the line 4. Uncomment it and change it to look like 5. Next, find the line 6. Uncomment it and make it look like 7. Save the file 8. Now you can restart SSH Now, no one will be able to login to root with out first logging in as admin and \u2019su -\u2019 to root, and you will be forcing the use of a more secure protocol. Just make sure you remember both passwords!<\/p>\n","protected":false},"excerpt":{"rendered":" Allowing the root user to login directly can be a major security issue. Here, i\u2019ll show you how to disable it so you can still login as root but just not directly, reducing the security risk. This will force an attacker to guess 2 separate passwords to gain root access. You will first need to… <\/p>\n
\n
\ngroupadd admin
\n<\/code>
\nuseradd admin \u2013gadmin<\/code>
\n\/\/ Please note -g in the second line<\/p>\n
\n(generated using)
\n perl -le 'print map { (\"a\"..\"z\", 0..9)[rand 36] } 1..12' <\/code><\/p>\npasswd admin
\nChanging password for user admin.
\nNew UNIX password:
\nRetype new UNIX password:
\npasswd: all authentication tokens updated successfully.
\n<\/code><\/p>\nLOGOUT OF SSH<\/h3>\n
\nssh admin@hostname.com<\/code>
\nPassword :0e05tjs0c3bm
\nThe authenticity of host ‘10.255.255.255 (10.255.255.255)’ can’t be established.
\nRSA key fingerprint is 6e:ea:03:08:72:8d:df:b5:00:cd:92:c8:24:74:de:46.
\nAre you sure you want to continue connecting (yes\/no) yes
\nadmin@host:~$
\nnow, at the command prompt type in
\nsu \u2013
\npassword:0e05tjs0c3bm<\/code><\/p>\n
\nvim \/etc\/ssh\/sshd_config<\/code><\/p>\n
\nProtocol 2, 1<\/code><\/p>\n
\nProtocol 2<\/code><\/p>\n
\nPermitRootLogin yes<\/code><\/p>\n
\nPermitRootLogin no<\/code><\/p>\n
\n:wq<\/code><\/p>\n
\n\/etc\/rc.d\/init.d\/sshd restart<\/p>\n