First of all, I agree with you that
PermitRootLogin without-password
is preferable.
The discussion I am interested in is whether direct password root login should remain enabled. On 01/12/2015 10:02 AM, Paul Wouters wrote: On Mon, 12 Jan 2015, Przemek Klosowski wrote: With root logins, all you have on the client machine is the IP the connection originated from. If people have to get in on their own accounts, those accounts leave audit trails, on multiple systems. More importantly, there is one root for all users---if one user needs to be blocked (e.g. sysadmin quits), the only solution is to change the root password everywhere. Individual accounts can be controlled independently, especially in setups with centralized account management like Kerberos/IPA. But if the single-password root is enabled, why would anyone use those granular methods? |
-- devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxxx https://admin.fedoraproject.org/mailman/listinfo/devel Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct