Reasoning behind a default remote root login ?

From: Lion-O (
Date: 11/24/04

Date: Tue, 23 Nov 2004 23:35:09 -0000

Hi there,

I've been messing with OpenBSD (the current version 3.6) for a while now
and by accident stumbled upon the possibility to remotely login as root
using ssh. The box in question has just been installed and although it
was me stating to be willing and run the ssh daemon I somewhat wonder
how this setting fits in the description where a default setup will
protect the users against most common harm. Personally I'd never allow
remote root logins alltogether.

I've been looking on google already and although I picked out a few
articles on mailinglists most of them seem to focus on *how* to allow or
disallow a way to login remotely using ssh, either by using passwords or
key authentication, but I didn't find any documentation explaining the
reasoning behind this particular case (and from all the documentation
I've read so far I can't believe that there wouldn't be some reasoning
behind it).

So my question is: Does anyone know why OpenBSD allows remote root
logins by default when SSH has been enabled, or can point me to a
location on the web where I might find this information (when
considering the massive amount of documentation it wouldn't surprise me
if I overlooked something).

Thanks in advance!

And in case any newbie's are also reading this; 'howto disable remote
root logins with SSH':

IMO remote root logins are bad since you're making it easier for the
remote user (who could be an attacker) to gain root access. Just have
them login as regular user and use either 'su' or 'sudo' (and keep in
mind that OpenBSD might offer other or better options but since I'm not
that familiar with OpenBSD yet I can't comment on them). This can be
manually allowed or disallowed in SSH by modifying:

Look for the "Authentication:" header, here you'll find the option
"PermitRootLogin". Even if this is commented out its best to uncomment
it and deny it by adding "No" behind it. So:

PermitRootLogin No

...Unless ofcourse you're absolutely sure that your version of sshd
doesn't allow this by default.

Groetjes, Peter
.\\ PGP/GPG key: