How does a EC2 machine prevents ssh root access with a warning?
I've setup a machine on EC2 running Debian stretch.
Upon trying to ssh as root, I get the following message:
$ ssh -i "mykey" root@machine
Please login as the user "admin" rather than the user "root".
^CConnection to machine closed.
Note the ^C - the command doesn't terminate.
I can login as admin without a problem, and I'm aware of why this is done - I'm not sure about how, though.
My first hunch was the shell
admin@machine:~$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash
Nope. I checked nologin just in case:
admin@machine:~$ /usr/sbin/nologin This account is currently
not available.
Different message.
What is the mechanism that makes the system print out the message on login?
shell ssh root amazon-ec2 aws
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
add a comment |
I've setup a machine on EC2 running Debian stretch.
Upon trying to ssh as root, I get the following message:
$ ssh -i "mykey" root@machine
Please login as the user "admin" rather than the user "root".
^CConnection to machine closed.
Note the ^C - the command doesn't terminate.
I can login as admin without a problem, and I'm aware of why this is done - I'm not sure about how, though.
My first hunch was the shell
admin@machine:~$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash
Nope. I checked nologin just in case:
admin@machine:~$ /usr/sbin/nologin This account is currently
not available.
Different message.
What is the mechanism that makes the system print out the message on login?
shell ssh root amazon-ec2 aws
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
add a comment |
I've setup a machine on EC2 running Debian stretch.
Upon trying to ssh as root, I get the following message:
$ ssh -i "mykey" root@machine
Please login as the user "admin" rather than the user "root".
^CConnection to machine closed.
Note the ^C - the command doesn't terminate.
I can login as admin without a problem, and I'm aware of why this is done - I'm not sure about how, though.
My first hunch was the shell
admin@machine:~$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash
Nope. I checked nologin just in case:
admin@machine:~$ /usr/sbin/nologin This account is currently
not available.
Different message.
What is the mechanism that makes the system print out the message on login?
shell ssh root amazon-ec2 aws
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
I've setup a machine on EC2 running Debian stretch.
Upon trying to ssh as root, I get the following message:
$ ssh -i "mykey" root@machine
Please login as the user "admin" rather than the user "root".
^CConnection to machine closed.
Note the ^C - the command doesn't terminate.
I can login as admin without a problem, and I'm aware of why this is done - I'm not sure about how, though.
My first hunch was the shell
admin@machine:~$ grep root /etc/passwd
root:x:0:0:root:/root:/bin/bash
Nope. I checked nologin just in case:
admin@machine:~$ /usr/sbin/nologin This account is currently
not available.
Different message.
What is the mechanism that makes the system print out the message on login?
shell ssh root amazon-ec2 aws
shell ssh root amazon-ec2 aws
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
edited Nov 25 '18 at 21:05
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
asked Nov 25 '18 at 16:42
goncalopp
1,99111626
1,99111626
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
I figured it out, in the process of writing the question.
I initially assumed that root had no ssh config, because bash didn't tab-complete. Of course, you cannot tab-complete if you don't have permissions to the files...
admin@machine:~$ sudo su
root@machine:# cat /root/.ssh/authorized_keys
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo
'Please login as the user "admin" rather than the user
"root".';echo;sleep 10" ssh-rsa ...
So that explains it. This is done through a custom command in the authorized_keys format - see the AUTHORIZED_KEYS FILE FORMAT section on the sshd manual for details.
As has been pointed out in comments, the reason for the sleep is likely so that PuTTY users have time to read the message
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
Why not usingPermitRootLogin noinsshd_config?
– Rui F Ribeiro
Nov 25 '18 at 17:04
1
My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work".
– Ulrich Schwarz
Nov 25 '18 at 17:04
You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to theAUTHORIZED_KEYS FILE FORMATsection of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered...
– RubberStamp
Nov 25 '18 at 17:28
@RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error
– goncalopp
Nov 25 '18 at 21:02
@UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason
– goncalopp
Nov 25 '18 at 21:03
|
show 4 more comments
Below mentioned configuration will refuse root user to be logged in
vim /etc/ssh/sshd_config
PermitRootLogin no
AllowUsers [username]
answered 7 hours ago
Surya SG
61
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f484061%2fhow-does-a-ec2-machine-prevents-ssh-root-access-with-a-warning%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
I figured it out, in the process of writing the question.
I initially assumed that root had no ssh config, because bash didn't tab-complete. Of course, you cannot tab-complete if you don't have permissions to the files...
admin@machine:~$ sudo su
root@machine:# cat /root/.ssh/authorized_keys
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo
'Please login as the user "admin" rather than the user
"root".';echo;sleep 10" ssh-rsa ...
So that explains it. This is done through a custom command in the authorized_keys format - see the AUTHORIZED_KEYS FILE FORMAT section on the sshd manual for details.
As has been pointed out in comments, the reason for the sleep is likely so that PuTTY users have time to read the message
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
Why not usingPermitRootLogin noinsshd_config?
– Rui F Ribeiro
Nov 25 '18 at 17:04
1
My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work".
– Ulrich Schwarz
Nov 25 '18 at 17:04
You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to theAUTHORIZED_KEYS FILE FORMATsection of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered...
– RubberStamp
Nov 25 '18 at 17:28
@RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error
– goncalopp
Nov 25 '18 at 21:02
@UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason
– goncalopp
Nov 25 '18 at 21:03
|
show 4 more comments
I figured it out, in the process of writing the question.
I initially assumed that root had no ssh config, because bash didn't tab-complete. Of course, you cannot tab-complete if you don't have permissions to the files...
admin@machine:~$ sudo su
root@machine:# cat /root/.ssh/authorized_keys
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo
'Please login as the user "admin" rather than the user
"root".';echo;sleep 10" ssh-rsa ...
So that explains it. This is done through a custom command in the authorized_keys format - see the AUTHORIZED_KEYS FILE FORMAT section on the sshd manual for details.
As has been pointed out in comments, the reason for the sleep is likely so that PuTTY users have time to read the message
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
Why not usingPermitRootLogin noinsshd_config?
– Rui F Ribeiro
Nov 25 '18 at 17:04
1
My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work".
– Ulrich Schwarz
Nov 25 '18 at 17:04
You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to theAUTHORIZED_KEYS FILE FORMATsection of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered...
– RubberStamp
Nov 25 '18 at 17:28
@RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error
– goncalopp
Nov 25 '18 at 21:02
@UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason
– goncalopp
Nov 25 '18 at 21:03
|
show 4 more comments
I figured it out, in the process of writing the question.
I initially assumed that root had no ssh config, because bash didn't tab-complete. Of course, you cannot tab-complete if you don't have permissions to the files...
admin@machine:~$ sudo su
root@machine:# cat /root/.ssh/authorized_keys
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo
'Please login as the user "admin" rather than the user
"root".';echo;sleep 10" ssh-rsa ...
So that explains it. This is done through a custom command in the authorized_keys format - see the AUTHORIZED_KEYS FILE FORMAT section on the sshd manual for details.
As has been pointed out in comments, the reason for the sleep is likely so that PuTTY users have time to read the message
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
I figured it out, in the process of writing the question.
I initially assumed that root had no ssh config, because bash didn't tab-complete. Of course, you cannot tab-complete if you don't have permissions to the files...
admin@machine:~$ sudo su
root@machine:# cat /root/.ssh/authorized_keys
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo
'Please login as the user "admin" rather than the user
"root".';echo;sleep 10" ssh-rsa ...
So that explains it. This is done through a custom command in the authorized_keys format - see the AUTHORIZED_KEYS FILE FORMAT section on the sshd manual for details.
As has been pointed out in comments, the reason for the sleep is likely so that PuTTY users have time to read the message
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
edited Nov 25 '18 at 21:09
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
answered Nov 25 '18 at 16:46
goncalopp
1,99111626
1,99111626
Why not usingPermitRootLogin noinsshd_config?
– Rui F Ribeiro
Nov 25 '18 at 17:04
1
My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work".
– Ulrich Schwarz
Nov 25 '18 at 17:04
You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to theAUTHORIZED_KEYS FILE FORMATsection of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered...
– RubberStamp
Nov 25 '18 at 17:28
@RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error
– goncalopp
Nov 25 '18 at 21:02
@UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason
– goncalopp
Nov 25 '18 at 21:03
|
show 4 more comments
Why not usingPermitRootLogin noinsshd_config?
– Rui F Ribeiro
Nov 25 '18 at 17:04
1
My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work".
– Ulrich Schwarz
Nov 25 '18 at 17:04
You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to theAUTHORIZED_KEYS FILE FORMATsection of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered...
– RubberStamp
Nov 25 '18 at 17:28
@RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error
– goncalopp
Nov 25 '18 at 21:02
@UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason
– goncalopp
Nov 25 '18 at 21:03
Why not using
PermitRootLogin no in sshd_config?– Rui F Ribeiro
Nov 25 '18 at 17:04
Why not using
PermitRootLogin no in sshd_config?– Rui F Ribeiro
Nov 25 '18 at 17:04
1
1
My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work".
– Ulrich Schwarz
Nov 25 '18 at 17:04
My guess is: that should terminate, and a windowed client is likely to close the window. Without the sleep, your average PuTTY user would only notice that "it doesn't work".
– Ulrich Schwarz
Nov 25 '18 at 17:04
You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to the
AUTHORIZED_KEYS FILE FORMAT section of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered...– RubberStamp
Nov 25 '18 at 17:28
You may want to clarify the subject of your question... "How does an EC2 remote ssh server send a login warning message?" ... and then you could greatly improve your answer by providing an appropriate reference to the
AUTHORIZED_KEYS FILE FORMAT section of the manpage for ssh ... otherwise, it's very unclear what is being asked and answered...– RubberStamp
Nov 25 '18 at 17:28
@RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error
– goncalopp
Nov 25 '18 at 21:02
@RuiFRibeiro I didn't create the AMI image, so I can't know for sure, but my guess is that having the user message there helps people, compared to a generic "Permission denied" error
– goncalopp
Nov 25 '18 at 21:02
@UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason
– goncalopp
Nov 25 '18 at 21:03
@UlrichSchwarz Good point, I didn't think of PuTTY, that's probably the reason
– goncalopp
Nov 25 '18 at 21:03
|
show 4 more comments
Below mentioned configuration will refuse root user to be logged in
vim /etc/ssh/sshd_config
PermitRootLogin no
AllowUsers [username]
answered 7 hours ago
Surya SG
61
add a comment |
Below mentioned configuration will refuse root user to be logged in
vim /etc/ssh/sshd_config
PermitRootLogin no
AllowUsers [username]
answered 7 hours ago
Surya SG
61
add a comment |
Below mentioned configuration will refuse root user to be logged in
vim /etc/ssh/sshd_config
PermitRootLogin no
AllowUsers [username]
answered 7 hours ago
Surya SG
61
Below mentioned configuration will refuse root user to be logged in
vim /etc/ssh/sshd_config
PermitRootLogin no
AllowUsers [username]
answered 7 hours ago
Surya SG
61
answered 7 hours ago
Surya SG
61
answered 7 hours ago
Surya SG
61
answered 7 hours ago
Surya SG
61
61
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f484061%2fhow-does-a-ec2-machine-prevents-ssh-root-access-with-a-warning%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
