restart SSH | PeteNetLive

KB ID 0001317

Problem

First of all not being able to connect to your Ubuntu server via SSH as root is ‘by design’, and it’s a perfectly good security measure. I do find it interesting that every hosting company I ever used, spin up a new machine and then email me the root password and they’ve enabled it anyway?

I needed to enable this recently and the internet is full of posts saying ‘just edit the config file, and restart the service’. What they don’t tell you is that the root user is disabled by default, even with a valid password, IT STILL WONT WORK!

Solution

Connect to your Ubuntu machine, and reset the root user password, (so you know what it is).

[box]sudo passwd root[/box]

As shown you will need to enter your password first, then enter and confirm a new root password.

Then ‘unlock the root account’;

[box]sudo passwd -u root[/box]

Note: If you ever want to ‘lock‘ it again, use (sudo passwd -l root).

Now you can edit the sshd config file;

[box]sudo nano /etc/ssh/sshd_config[/box]

Locate the line ‘PermitRootLogin’ and change it so it ONLY says yes (as below).

Note: Here I’m also changing the SSH port (to 2223 in this example, from the default port of 22), I usually change the default SSH port.

Now finally, restart the SSH Daemon, (that always looks like it’s spelled incorrectly!) With the following command;

[box]sudo service sshd restart[/box]

Don’t forget if, (like me) you changed the port, you will need to specify that in your client connection software (i.e. PuTTy or RoyalTSX).

Problem

The following is by no means an extensive list of everything that can be done. It’s just a run though of what I would consider ‘good practice’.

Solution

Create a user for SSH and Remove Shell access for the ‘root’ user.

1. Connect to the server via SSH or open a terminal session and su to root. Create a new user then set and confirm the new users password.

[box] useradd {username}
passwd {username} [/box]

2. Test access for your new user.

3. To make changes to shell access, you need to edit the sshd_config file, to do that I’m using the nano editor.

Note: If you do not have nano installed, run ‘yum install nano’.

[box] nano /etc/ssh/sshd_config[/box]

4. Locate PermitRootLogin and change it to no.

5. Locate the PermitRootLogin without-password”. line and comment it out (prefix it with a hash #, (or pound if you’re American).

[box] # PermitRootLogin without-password”.[/box]

Limit SSH / Shell access to particular User(s)

6. Add the following line to allow the user you create above only.

[box] AllowUsers {username}[/box]

Note: If you had multiple users, you can add them separated by a space.

Disable SSH Version 1 and Force SSH Version2

7. Ensure Protocol 2 is NOT hashed out and activation of protocol 1 IS hashed out.

Change the SSH / shell Port Number

8. SSH by default runs over TCP port 22, this is a well know port to advertise to the outside world, to change it (in this case to 2200), change the existing Port 22 line;

[box] Port 2200[/box]

Note: There is not hard and fast rule on what port to use, but for production, I would suggest a random number above 1024 but below 65535.

9. At this point close nano and save the changes, (press CTRL+W and Y to save the changes).

10. The changes will not take effect until after you have restarted the SSH service/daemon.

[box] service sshd restart[/box]

11. At this point you can check that the root user no longer has SSH / Shell access.

12. But your SSH user has.

PeteNetLive

Technology that 'Just Works'

Tag Archives: restart SSH

Ubuntu: Allow SSH access for ‘root’ user

Problem

Solution

Related Articles, References, Credits, or External Links

Linux (CentOS) Securing and Hardening SSH / Shell Access

Problem

Solution

Create a user for SSH and Remove Shell access for the ‘root’ user.

Limit SSH / Shell access to particular User(s)

Disable SSH Version 1 and Force SSH Version2

Change the SSH / shell Port Number

Related Articles, References, Credits, or External Links