Restrict root users to log on through certificates only

Restrict root users to log on through certificates only

It is very dangerous to allow the root user to log on directly with the password. This is usually done: Prohibit the root user from logging on directly and create a common account, it is safe to switch through this normal account only when the root account is used. However, some users may find it difficult. For example, when uploading files, you can only upload files using the normal account, after uploading, you must change the owner and use the mv command to move the file.

If you have the same troubles as me, the following content will be helpful to you.

The first step is to create a user key, which I created through xshell. Key type: RSA; Key Length: 2048 bits.

The second step is to add the Public Key generated in step 1 to the/root/. ssh/authorized_keys file of the root account of the target server. (During the first addition, you may need to create the. ssh directory and the authorized_keys file. After the creation, set the. ssh directory permission to 700 and the authorized_keys File Permission to 600 ).

Step 3: Modify the/etc/ssh/sshd_config file and find PermitRootLogin. If the file is commented out, uncomment it and change "yes" or "no" after it to "without-password.

Restart the ssh service.

This article permanently updates the link address: