Is it redundant or useful to add a UFW rule to deny root when ssh already does?
3
votes
3
answers
387
views
I manage a Debian (Bookworm) host. The sshd config is set to disallow login as root. I've tested that one cannot login as root, as expected.
However, I see hundreds of login attempts daily as root in /var/log/auth.log. Even though I have what I think is adequate reason to believe they can't succeed, the constant brute-force attacks make me uneasy.
I am considering adding a ufw rule in /etc/ufw/before.rules to block any attempt to connect with ssh as root.
Is there any value in adding the proposed rule or something like it? Or would that be redundant and/or potentially cause problems?
Asked by Gojira
(133 rep)
Aug 5, 2025, 12:33 AM
Last activity: Aug 5, 2025, 05:53 PM
Last activity: Aug 5, 2025, 05:53 PM