I'm not really on one side of the argument or the other, but disabling root logi... | Hacker News

Hacker News new | past | comments | ask | show | jobs | submit

login

michaelmior on May 2, 2014 | parent | context | favorite | on: SSH Kung Fu

I'm not really on one side of the argument or the other, but disabling root login means that an attacker doesn't automatically know the name of an account where login is permitted for one. Certainly not the best security mechanism, but if there happened to be some 0-day on the SSH server, you're much more likely to be safe from automated attacks.

Sae5waip on May 2, 2014 [–]

Automated 0-day attack: fair point.

Though direct remote code execution is probably much, much more likely than authentication bypass.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact