I originally entered this as a Linux Fedora Core 5 bug/rfe: Ref. https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=201794 I was referred "upstream", and here I am. :-) For various reasons, allowing root acess by default is desirable. That's fine.... I'm not asking to change the default. It would be beneficial to bring that little gem to sysadmins' attention by producing a periodic (daily) warning via the Logwatch report. I would like to see something in my Logwatch report (SSHD section) like: Warning: root access is allowed via ssh. Ref /etc/ssh/sshd_config Perhaps a new option in /etc/ssh/sshd_config: PermitRootLoginWarn yes Or, as the Fedora people suggested, perhaps a new value for the PermitRootLogin option: yes - allow access (default) no - deny access warn - implies "allow access", issue periodic (daily) warning via logwatch mechanism. Personally, I prefer a new option keyword, I think it is more clear. Both options should be anabled by default, the syadmin can then make an informed decision: 1 - turn off the warning (yes, I know, I want that) 2 - deny root logon (say what?! Thanks for telling me, I'll stop that right now) 3 - I like seeing the warning everyday :-) Thanks :-)
I don't see any point to this. If you want something like this just add a cron job: egrep -i '^permitrootlogin.*no' /etc/ssh/sshd_config || logger root login allowed via ssh
(In reply to comment #1) > I don't see any point to this. The point is that after an initial install, root login is permitted via a remote connection. (granted, authentication is still required, I'm not suggesting that un-authenticated access is allowed.) If people knew enough to add the suggested cron job, then they also know enough to ensure the PermitRootLogin option is correct for their own environment and therefore do not need the cron jb. If sshd scheduled such a cron job when starting and seeing both "PermitRootLogin yes" and "PermitRootLoginwarn yes" options set, there would be no "surprises". Thanks for your consideration.
Even in your proposal you had the default as "yes" (ie no warning), so the admin would still have to explicitly enable it. If you want to enable something, enable a cron job. So, no, I don't think we'll be implementing this.
Yes, my example showed the PermitRootLogin yes (default) That should have read (current default) and then the warn setting became the new defalt option, if you opted to add a new value to the PermitRootLogin option. Anyway... WONTFIX.... Thant's fine, all I can do is make the suggestion. It doesn't affect me (anymore),I just thought it would be little effort, and help new users. Thanks for the speedy replies. Regards.
Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.