deny root remote login to ssh

[dallas]

Having your sshd die on you is scary.. so if you are working on remote boxen, always run a usermode sshd on port 4000 or something as a spare in case something goes wrong... or webmin or something..

 

 

Something that I do with my sshd_config...

 

 

Code:

#Port 22
Protocol 2
#ListenAddress 0.0.0.0
#ListenAddress ::

 

 

change from Protocol 2,1 because having it has 2,1 doesn't necessarily mean 1 is a fallback method; ie sshd might just negotiate 1 first up which is just nasty. so make sure your box does not support telnet or ssh 1.

I make it listen on a single ip address thats unused from other services.. this helps to segregate services or if you want to tcp wrapper the service.

 

Also some other neat settings

 

Code:

AllowUsers dallas, anyweb
DenyUsers www, oracle, daemon, ftpd, spamd

 

and other popular system accounts (who in most cases have their shell set to /bin/false)

 

 

da!!as