1

We have the centralized server which has passwordless SSH configured to access other Linux servers within our environment. The issue we are facing is that when we disable root direct console access on Linux servers then passwordless SSH doesn't work. It asks for the password.

Is there any workaround for this so our passwordless SSH works with the disabled direct console root login. The following file is where I am adding the no option.

/etc/ssh/sshd_config:

PermitRootLogin no
2
  • 1
    Don't ssh as root from the central server. Use a non privileged user for the ssh connections and then sudo for the specific privileged tasks you need to run.
    – Matt
    May 8, 2014 at 19:29
  • How exactly did you disable root direct console access (it looks like you did more than that)? Are you trying to log in with SSH as root or with some other account? If you disable root logins with SSH then obviously you won't be able to log in with SSH as root. Do you want to be able to log in with SSH with a key? May 8, 2014 at 22:52

2 Answers 2

2

Completely rewritten answer as I think I misunderstood what you're wanting to do.

If you want to allow public-key authentication to the root user, but not password based authentication, you need to set:

PermitRootLogin prohibit-password

Setting it to no prevents all logins entirely.

2
  • @ Patick, we have scripts running from our central server and that's the reason we are looking for a solution which will not prompt for the password. It appears with this option anyone can login without the root password?
    – user67186
    May 12, 2014 at 14:47
  • @user67186 why do you think that? Have you read the documentation (man sshd_config) and in particular the section describing PermitRootLogin? Dec 15, 2019 at 17:50
0

I normally use this configuration:

PermitRootLogin yes
PasswordAuthentication no

With also:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys
ChallengeResponseAuthentication no
GSSAPIAuthentication no

Then in .ssh/authorized_keys I have a list of the public SSH keys of the clients that should be allowed to have access, and no password will be prompted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .