SYS‐255 Security SSH - aljimenez28/champlain GitHub Wiki

Objective

Disable SSH login for the root account on the dhcp01 Rocky Linux server to prevent brute-force attacks against the known UID 0 (root) account.

Steps Taken

Connected to dhcp01 via SSH
- Used PuTTY from wks01 to SSH into the dhcp01 VM as a regular user with sudo privileges.
Edited the SSH Daemon Configuration
```
sudo vi /etc/ssh/sshd_config
```

Located the line:
```
PermitRootLogin prohibit-password
```
Changed it to:
```
PermitRootLogin no
```
Removed any # to ensure the line was active.

Restarted the SSH Service
```
sudo systemctl restart sshd
sudo systemctl status sshd
```
- Confirmed the service was active (running) with the new configuration.
Tested Root Login
```
ssh root@<dhcp01_IP>
```
- Attempted to log in as root from another PuTTY session.
- Received Authentication failure, proving that remote root login is blocked.
Verified in Logs
- Triggered a failed root login attempt to generate log entries.
- Checked system logs:
```
sudo journalctl -u sshd --since "5 minutes ago"
sudo lastb
```
- Captured screenshots showing the denied login.

Key Commands Reference

sudo vi /etc/ssh/sshd_config   # Edit SSH daemon configuration
sudo systemctl restart sshd    # Apply changes
sudo systemctl status sshd     # Confirm service is running
ssh root@<IP>                  # Test root login
sudo journalctl -u sshd         # View SSH-related journal entries
sudo lastb                       # View failed login attempts

Log File Differences

Log Source	Purpose
/var/log/btmp	A binary log that records failed login attempts (any service). View with lastb. Good for auditing brute-force or unauthorized access attempts.
journalctl -u sshd	A systemd journal showing all sshd service events (both successful and failed). Use journalctl to filter by time, service, or priority.

In short: /var/log/btmp is focused on failed logins, while journalctl -u sshd provides a complete timeline of SSH daemon activity.

Outcome

Remote root access through SSH is now fully disabled on dhcp01. Even with the correct password, the SSH daemon rejects all root login attempts, protecting the system from password-guessing attacks.