Thinking Security for the Day: Media Temple - Create Sudo user and disable root login on MT DV

This has been bugging me for some time... I'm just not comfortable with the MT DV plans somewhat supported and backed ssh Root login being turned on.

I found this: http://wiki.mediatemple.net/w/Disabling_SSH_Login_for_root_user and made it happen, especially when taking somewhat of a half break over the holidays:

With a good password, you do limit your exposure to a brute force attack. However, it still may be possible. Although technically unsupported by (mt) Media Temple, here are some instructions for disabling the root user and allowing another user to assume the root users permissions. This adds another layer of security because an additional username and password must now be entered before gaining the root user privileges.
Before you disable root logins you should add an administrative user that can ssh into the server and become root with su.

In the following example, we are using admin for the username. This is just a example and can be replaced with any username you wish to use.

1. Add the user. In the following example, we will use the user name admin. The command adduser will automatically create the user, initial group, and home directory.

[root@root ~]# adduser admin
[root@root ~]# id admin
uid=10018(admin) gid=10018(admin) groups=10018(admin)
[root@root ~]# ls -lad /home/admin/
drwx------ 2 admin admin 4096 Jun 25 16:01 /home/admin/

2. Set the password for the admin user. When prompted, type and then retype the password.

[root@root ~]# passwd admin
Changing password for user admin.
New UNIX password:
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
[root@root ~]#

3. SSH to the server with the new admin user and ensure that the login works.

[root@root ~]#ssh admin@my.ip.or.hostname
admin@my.ip.or.hostname's password:
[admin@admin ~]$

4. Verify that you can su (switch user) to root with the admin user.

[admin@admin ~]$ su -
Password:
[root@root ~]$ whoami
root

5. Edit /etc/ssh/sshd_config with your favorite text editor.

[root@root ~]# vi /etc/ssh/sshd_config

Change this line:

#PermitRootLogin yes

to this:

PermitRootLogin no

6. Ensure that you are logged into the box with another shell before restarting sshd to avoid locking yourself out of the server.

[root@root ~]# /etc/init.d/sshd restart
Stopping sshd: [ OK ]
Starting sshd: [ OK ]
[root@root ~]#

You will now be able to ssh into your server with the admin user and then su - to the root user.