"PermitRootLogin no" should not proceed with root login
Damien Miller
djm at mindrot.org
Sun Feb 22 08:02:11 AEDT 2015
On Sat, 21 Feb 2015, tot-to wrote:
> Steps to reproduce:
> 1) PermitRootLogin no in sshd_config
> 2) login with "root" user from other host
>
> Present behaviour:
> 1) it asks for password 3 times and only then close the connection.
> 2) cpu consumption during bruteforce "attacks".
This is intentional behaviour. The intention is to not give clues as
to which accounts may be valid for login.
> Expected behaviour:
> Immediate disconnect/login fail
If you want this, then use:
Match user root
MaxAuthTries 0
More information about the openssh-unix-dev
mailing list