PermitRootLogin no

[askylark]

when i set PermitRootLogin no in /etc/ssh/sshd_config, the putty cannot login to the linux.
but cockpit's terminal still can login to the linux system.

[martinpitt]

Yes, cockpit isn't SSH. The equivalent file for cockpit is /etc/cockpit/disallowed-users, and for new installations it also defaults to disallowing "root". It just doesn't exist if you upgraded from a version earlier than https://cockpit-project.org/blog/cockpit-280.html

[mac2net]

Even without changing /etc/cockpit/disallowed-users Cockpit allows for root login when accessing a VM through Virtual Machine's internal network – usually 192.168.122.x

[martinpitt]

Access how exactly? Does that VM have /etc/cockpit/disallowed-users ?

[mac2net]

I did a test install of the recently released Fedora Server 40 for a VM with root access over ssh and a user with admin access. This installs about 4-5 package groups including Cockpit. After the install, I usually add Cockpit Navigator first and access /etc/cockpit/disallowed-users, but I forgot the last time.
From within Cockpit running on the Fedora Server metal, I went to "Add a New Host" and entered the VM's internal IP (192.168.122.x). And I was in and then I realised I forgot to change /etc/cockpit/disallowed-users.

[martinpitt]

"Add new host" uses SSH to connect to the remote host, so that again uses PermitRootLogin no in /etc/ssh/sshd_config. And of course ssh has another setting whether you are allowed to login as root with key auth.

[mac2net]

So my experience is correct? Because I set the VM to permit ssh root login during the install...?

[martinpitt]

At least so far I haven't seen anything which is incorrect. If you can log into your VM with ssh directly, you can also log in with "Add remote host", as that is literally the same from the VM's point of view.