Consider the following scenario:

I have a Debian-ssh-server setup and exposed it to the internet for some time for testing. Also I have an account which is basically configured as root in the sudoers file (I know this is poorly mis-configured!) and of course no root login is permitted. The authentication is password and not key based.

What happened is the following, I have set up the server from my own laptop and I could login to this account from anywhere, at home of course and even from other networks. But as I tried to login from another machine I got the 'access denied' message.

What grinds my gears is why could I login from my home machine, the access should have been denied either, shouldn't it?

  • if your client a command line client execute it with command ssh -vvvvvvv it will give very understandable output to know which authentication is used – Kiwy Jan 16 '14 at 9:02

Open the file /etc/ssh/sshd_config and change the next line:

PermitRootLogin without-password


PermitRootLogin yes

Finally, reboot the server.


You should look at multiple things:

  1. Look at the log files on the server: /var/log/auth.log, /var/log/secure as Jenny did propose in her comment.
  2. Configuration of your ssh ( /etc/ssh/ssh_config on your client machine ), it might be set not to use password authentication ( entyr PasswordAuthentication set to no).
  3. Start ssh with -v option (ssh -v) to get verbose output
  4. Configuration of the sshd ( /etc/ssh/sshd_config ) on the server. It could only listen to connections coming from certain IP addresses ( e.g. the one from you router ).

If you can, try to login from the client to another machine, that way you can pinpoint which of both machines is the problem (although they might be both the problem).

  • I'd add a third thing: Look at the sshd logs on the server. Where they are will depend on how syslog is setup on the server; common places are /var/log/auth.log, /var/log/secure. – Jenny D Jan 16 '14 at 9:02
  • @JennyD Uh, yes of course %-) Should/can I include that in the answer (with attribution of course), so it is less easy to overlook? – Timo Jan 16 '14 at 9:16
  • @Timo Yes, generally you should. I usually add links to both the comment (the timestamp is a link!) as well as the user's profile page when I do, and have never had anyone complain. – user Jan 16 '14 at 9:21
  • @MichaelKjörling Thank you. I got baffled that in edit screen you don't have the comments to reference anymore. Had to close, open edit in another window ... – Timo Jan 16 '14 at 9:30
  • What I forgot to mention is, that I could login from the other machine, after I changed the sudoers configuration. I added my account to the sudoers group and deleted it from the sudoers file. – Määäxx Jan 16 '14 at 10:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.