Avoid logging in to instances as root-Elastic Compute Service(ECS)-阿里云帮助中心

When you create a Linux instance, avoid using the root account to log in. We recommend using the ecs-user account instead.

Security risks

The root account has the highest permissions in the system. Although this provides convenience for system administration, it also creates significant security risks. If the root account credentials, such as the password or SSH key, are compromised, an attacker can gain full control of your server. This may lead to the following consequences:

Data destruction: An attacker can delete all business data, logs, and backups.
Malware installation: An attacker can install ransomware, cryptomining software, or backdoors.
Sensitive information theft: Core assets, such as business code, customer data, and payment information, can be exposed and stolen.
Lateral movement attack: An attacker can use the compromised server as a launchpad to attack other servers in your internal network, causing widespread damage.
Erasing operational traces: An attacker can easily modify or delete log files, making it extremely difficult to trace and investigate security incidents.

Best practices

Using the ecs-user account for daily login and management not only limits the potential attack surface but also requires that all privileged operations are executed by using sudo. This creates a clear and auditable record of operations and establishes accountability.

Console

When you create an instance on the Instance Buy page, set Logon Username to ecs-user.

Specific versions of Linux images support ecs-user. If your image does not, see Multi-user remote login to manually create ecs-user and grant it sudo permissions.

API

When you create an instance by using the RunInstances or CreateInstance API operation, if you set the ImageOptions.LoginAsNonRoot parameter to true, the instance uses the ecs-user username instead of root. You also cannot reset the password for the root user.

If you do not have a key pair, you can call the CreateKeyPair operation to create one.

Compliance capabilities

Check: Find instances with root login

Go to ECS Insight.
On the Security tab, click the Use of Non-root Users for Logons to Linux ECS Instances check item to view the Linux instances that use the root account for logins.

Block: Prevent root account usage in operations

You can use a RAM policy to proactively block the use of the root account for operations such as creating new Linux instances. The policy can be applied at the organizational or account level.

For enterprise users:

Log on to the Resource Directory console by using your Alibaba Cloud account. In the left-side navigation pane, click Control Policy. Create a custom policy and paste the following JSON content.

Restrict the use of the root identity for operations such as creating instances, mounting system disks, and replacing system disks.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:RunInstances",
                "ecs:CreateInstance",
                "ecs:ReplaceSystemDisk",
                "ecs:AttachDisk",
                "ecs:InvokeCommand"
            ],
            "Resource": "*",
            "Condition": {
                "Bool": {
                    "ecs:LoginAsNonRoot": [
                        "false"
                    ]
                }
            },
            "Effect": "Deny"
        }
    ]
}

In Resource Directory, attach the policy to the appropriate folder or member. The policy then blocks the specified operations for all accounts within that scope.

For individual users:
1. Log on to the RAM console by using your Alibaba Cloud account. In the left-side navigation pane, click Control Policy, and then create a custom policy with the same content as the one shown above.
2. Grant permissions by attaching the policy to a RAM user, RAM user group, or RAM role. For more information, see Manage access policies.

Remediate: Disable root account login

Create a standard user: Create a standard user for SSH logins. For detailed instructions, see Multi-user remote logon.
Log in to the instance: Log in to your Linux instance as the root user or a standard user.

Disable root account login: After you log in to the instance, run the following script to modify the SSH service configuration file.

#!/bin/bash
# Back up the original configuration file.
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak_$(date +%F)

# Disable SSH logon for the root user by changing the PermitRootLogin parameter to no.
sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

# Restart the SSH service to apply the changes.
# Note: The SSH service name may vary by distribution (for example, sshd or ssh). Modify the command based on your environment.
systemctl restart sshd || service sshd restart

Verification: After the operation is complete, do not disconnect the current session. Open a new terminal window and try to log in as the root user. This login attempt must fail. Then, try to log in as your regular user. Confirm that you can log in successfully and can use sudo to run privileged commands. You can safely disconnect all sessions only after the verification is successful.
After completing this verification, the results of the check may not update immediately. You can ignore this delay.