HighSSHBLWK-SSH-002

SSH root login is permitted

What this means

PermitRootLogin is set to “‹permit root login›”, allowing direct root logins over SSH. A compromised root password or key is a single step from full system control.

How to fix it

Set PermitRootLogin no (or prohibit-password if key-based root access is required) in /etc/ssh/sshd_config.

Check it yourself

Run a scan and look for BLWK-SSH-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads sshd_config and reports this check when:

permit_root_login == "yes"

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• CIS Benchmark 5.2.8
• MITRE ATT&CK T1078

Related checks

• SSH password authentication is enabled · BLWK-SSH-001
• SSH allows empty passwords · BLWK-SSH-003
• SSH X11 forwarding is enabled · BLWK-SSH-004
• SSH TCP forwarding/tunneling is enabled · BLWK-SSH-005
• SSH permits user-set environment variables · BLWK-SSH-006
• SSH tun-device (layer 2/3) tunneling is enabled · BLWK-SSH-007