Bug 2354 - please document that PermitRootLogin really checks for uid=0
Summary: please document that PermitRootLogin really checks for uid=0
Status: CLOSED WORKSFORME
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: Documentation (show other bugs)
Version: 6.7p1
Hardware: All All
: P5 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-02-20 12:18 AEDT by Christoph Anton Mitterer
Modified: 2016-08-02 11:22 AEST (History)
1 user (show)

See Also:

Attachments
0001-document-that-PermitRootLogin-checks-for-uid-0.patch (838 bytes, patch)
2015-02-21 15:18 AEDT, Christoph Anton Mitterer 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Christoph Anton Mitterer 2015-02-20 12:18:18 AEDT 
Hey.

I just found out that PermitRootLogin has the feature of really checking for UID=0 and not for the username "root"

I.e. it makes sense to have something like:
Match user toor
   PermitRootLogin no

Which would allow "root=0" to log in, but not e.g. the "toor=0" user to log in, if it is an alternative root user.

:) nice feature! (bad name, though ^^)

Cheers,
Chris.
Comment 1 Damien Miller 2015-02-21 09:42:23 AEDT 
I don't think this needs adjusting. Root in Unix is defined by UID and not username.
Comment 2 Christoph Anton Mitterer 2015-02-21 11:09:12 AEDT 
Is adding a one liner to the manpage really that issue? ;-)

Well I just thought that it might be handy to people... and especially for the BSD guys,.. or didn't they have the tradition of having a "toor" user which is root as well but not called root?
Comment 3 Christoph Anton Mitterer 2015-02-21 15:18:14 AEDT 
Created attachment 2553 [details]
0001-document-that-PermitRootLogin-checks-for-uid-0.patch
Comment 4 Christoph Anton Mitterer 2015-02-21 15:18:59 AEDT 
forgot to attach the trivial patch I've had made, just in case you change your mind!
Comment 5 Damien Miller 2016-08-02 10:41:27 AEST 
Close all resolved bugs after 7.3p1 release
Comment 6 Christoph Anton Mitterer 2016-08-02 11:22:35 AEST 
Shouldn't this be rather marked CLOSED WONTFIX?

I mean it's still not documented as I proposed, so that would be the more appropriate status?