Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

On my system ssh client authentication was allowed for root, but I wanted ssh client authentication to be allowed only for non root users. To disable ssh as root, I changed the PermitRootLogin yes to PermitRootLogin no, but now I am not able to ssh to my platform.

Can anybody let me know how I can enable ssh client authentication only for non root users?

share|improve this question
    
how do you invoke ssh? which errors do you get? maybe you disabled password-authentication and have not setup a public/private keypair for key-authentication? –  umläute Nov 4 '13 at 8:51
    
The way I wa invoking ssh is "ssh -o StrictHostKeyChecking=no root@hostname ,it is working but now I don't to login as root but some other user ,also when i tried doing ssh -o StrictHostKeyChecking=no nonrootuser@hostname,I was asked for password which earlier in case of root is disabled. –  Ram Nov 4 '13 at 9:05
    
Use ssh -vvvv and you'll get more clues. It's some configuration issue. –  goldilocks Nov 4 '13 at 10:50
    
@AmitSinghTomar so what happens if you provide the password for your nonrootuser? please add all the additional information (including your other comment) to your question, so people do not have to read the comments to fully understand your problem. –  umläute Nov 4 '13 at 11:52

2 Answers 2

The configuration of ssh server is done in a file called /etc/ssh/sshd_config. You should open this file and check the following:

1) Is there any of the following instructions?

AllowUsers ...
AllowGroups ...
DenyUsers ...
DenyGroups ...

If so, you will have to change it to allow connection as yourself.

2) Is there an instruction stating:

PermitEmptyPasswords no

If there is, it means ssh authentication can occur only through cryptographic keys. Since you obviously do not have one, this effectively bars you from ssh'ing into the system.

Change this to

PermitEmptyPasswords yes

so that you may test whether this is the whole solution to your problem. Once you have persuaded yourself ssh works for you too, establish a cryptographic key for yourself, and turn off Empty Passwords again. On the Net there many useful guides on how to use keys rather than passwords for authentication. Do it. Your security will greatly improve.

To complete this test, you will have to restart your SSH server, otherwise the changes introduced into /etc/ssh/sshd_config will not come into effect. Doing that depends on your system:

 sudo service ssh reload
 sudo systemctl reload sshd

(the first one is for Debian and derivatives, the second one for Arch Linux, Fedora, and in general systemd systems).

If this still does not solve the problem, you will have to povide debugging details, which can be obtained by issuing on the client machine

ssh me@my_pc -vv

which output a fair amount of data, useful for this task. There is an equivalent option to be issued on the server: you need first to stop the service,

 sudo service ssh stop
 sudo systemctl stop sshd

and then restart it with

 sudo /usr/sbin/sshd -Dd
 sudo /usr/bin/sshd -Dd

again for the to types of systems (I am not sure for systemd distros apart from Arch, perhaps the first form applies to all systems apart from Arch).

This will generate info necessary for debugging.

share|improve this answer

Not sure what kind of Linux / Unix you are using. I often use Ubuntu, where it's like this:

Login through SSH as a normal user is allowed by default. You can login by

ssh -l myuser myhost

or by

ssh myuser@myhost

Have you tried it like this? If yes, I can think of the following common reasons for failure:

  • Depending on your Linux / Unix, it may be necessary to add the user to a specific group (eg. ssh) to allow him to log in.
  • You also should check if you have allowed to login using passwords or using public keys only (in that case, you may need to generate a key or specify it while login).
  • You may have restricted login to certain IP's and are using another one.

To debug, try to use -vvv while trying to login with ssh, as this gives you a lot of debug messages about what SSH is trying and what happens.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.