Manage SSH access for the root user in Photon based appliances like SDDC Manager

Products

• VMware SDDC Manager / VCF Installer
• VMware vCenter Server

Issue/Introduction

This article provides the steps to modify the default SSH access behavior for the root user in VMware Photon OS-based appliances like SDDC Manager. Some of the related scenarios where this is applicable include:

• Enabling direct root login over SSH in SDDC Manager for performing security audit scans like STIG, rather than logging in as the vcf user and elevating privileges (which by default encounters an "Access Denied" error if attempted directly).

Cause

Standard Photon OS prevents root login over SSH by default for security purposes as mentioned on Permitting Root Login with SSH  .However some compliance audit scanners like STIG may require SSH access for root user.

For more details refer to Audit VCF SDDC Manager 9.X

Resolution

Momentarily enable SSH for root user by following below steps:

1. Access the desired SDDC Manager appliance VM console and log in using the root credentials.

2. Using vi editor, edit the SSH daemon configuration and set the PermitRootLogin parameter to desired state (yes/no) in the /etc/ssh/sshd_config file.

3. Restart the SSH daemon to apply the changes by executing the command:
   systemctl restart sshd

Once the concerned task (like Security scan) is completed, disable the access by editing the PermitRootLogin parameter back to its original value