Re: Allowing remote root login seems to be bad. Why? (SUMMARY)

[Ben Ford <ben@xxxxxxxxxxxxxx>]

It looks to me like you were fishing for confirmation of your  
preexisting notions, because none of the answers you received said  
that what you propose below is a replacement for disallowing remote  
root.

On Jun 3, 2008, at 4:02 AM, Ron Arts wrote:

> ...
> Though from the answers I may induce that it may be
> secure if:
>
> - you choose a strong root password

No single root password is as strong as an unknown username and two  
passwords.

> - there are no other users on the box

There should always be another user on the box:  you.

> - constrain logins to certain ip addresses.

Very weak security model.

> I think if you allow users on the box, you run a much
> larger risk anyway not? Hacking root from a local
> account is much easier than hacking root remotely.

Hacking root remotely is much easier than hacking an unknown user  
account remotely and then hacking root from the local account.

> ...
> But your answers still convinced me that though there
> are valid reasons to use local user accounts together with sudo,
> they do not necessarily apply to the setups I use.

Yes they do.

-b