audit-labs/audit-tools

A collection of scripts, queries, and other goodies you can use in an audit.

clone: git clone https://gitbay.org/audit-labs/audit-tools.git

cebaf4e251d2f13df51b7f6dab027e30bbac414f

signed_unknown_key

author: Christian Cleberg <hello@cleberg.net> · 2025-12-12T16:51:55Z
committer: <noreply@github.com>

enhance ssh_root_login.sh to check for keys if PermitRootLogin is enabled

Added checks and output for PermitRootLogin setting.

 os/linux/ssh_root_login.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/os/linux/ssh_root_login.sh b/os/linux/ssh_root_login.sh
index fdcdcf8..8de9aae 100755
--- a/os/linux/ssh_root_login.sh
+++ b/os/linux/ssh_root_login.sh
@@ -1,3 +1,15 @@
 #!/bin/bash
 
-grep -E "PermitRootLogin" /etc/ssh/sshd_config
+# Find the PermitRootLogin setting in the sshd_config file
+permit_root_login=$(grep -E "^[[:space:]]*PermitRootLogin" /etc/ssh/sshd_config)
+
+# Echo the setting for the user
+echo "Current PermitRootLogin setting:"
+echo "$permit_root_login"
+
+# Check if PermitRootLogin is set to something other than 'no'
+if ! echo "$permit_root_login" | grep -q "no"; then
+  echo ""
+  echo "PermitRootLogin is not set to 'no'. Checking for AuthorizedKeysFile location..."
+  grep -E "^[[:space:]]*AuthorizedKeysFile" /etc/ssh/sshd_config
+fi