<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.2"> <TITLE>RE: [Linux-cluster] Testing a fence program</TITLE> </HEAD> <BODY> Classification: UNCLASSIFIED this should be off-list but I can't. you can find me at pattonme at yahoo dot com PermitRootLogin forced-commands-only is precisely what you need. If the auditors really are too stupid to know what that does, then I'd tell them to come back after they have somebody 'splain it to them and they rewrite their simpleton "policy". Like I said, sounds like the auditors are just checking boxes without knowledge of what they are actually checking. Typical, unfortunately. You can of course leave "PermitRootLogin no # for stupid auditors" in sshd_config and change /etc/init.d/sshd to put the "-o PermitRootLogin" on the command line. You could even bury it in an options file. *grin* From a system auditing standpoint where one tries to minimize the number of places where security policies are stored, I'd use sudo and as a real account, not "nobody". Have fun with the daemon. </BODY> </HTML>