We have the centralized server which has passwordless SSH configured to access other Linux servers within our environment. The issue we are facing is that when we disable root direct console access on Linux servers then passwordless SSH doesn't work. It asks for the password.

Is there any workaround for this so our passwordless SSH works with the disabled direct console root login. The following file is where I am adding the no option.


PermitRootLogin no
  • 1
    Don't ssh as root from the central server. Use a non privileged user for the ssh connections and then sudo for the specific privileged tasks you need to run. – Matt May 8 '14 at 19:29
  • How exactly did you disable root direct console access (it looks like you did more than that)? Are you trying to log in with SSH as root or with some other account? If you disable root logins with SSH then obviously you won't be able to log in with SSH as root. Do you want to be able to log in with SSH with a key? – Gilles 'SO- stop being evil' May 8 '14 at 22:52

Completely rewritten answer as I think I misunderstood what you're wanting to do.

If you want to allow public-key authentication to the root user, but not password based authentication, you need to set:

PermitRootLogin prohibit-password

Setting it to no prevents all logins entirely.

| improve this answer | |
  • @ Patick, we have scripts running from our central server and that's the reason we are looking for a solution which will not prompt for the password. It appears with this option anyone can login without the root password? – user67186 May 12 '14 at 14:47
  • @user67186 why do you think that? Have you read the documentation (man sshd_config) and in particular the section describing PermitRootLogin? – roaima Dec 15 '19 at 17:50

I normally use this configuration:

PermitRootLogin yes
PasswordAuthentication no

With also:

RSAAuthentication yes
PubkeyAuthentication yes
AuthorizedKeysFile      .ssh/authorized_keys
ChallengeResponseAuthentication no
GSSAPIAuthentication no

Then in .ssh/authorized_keys I have a list of the public SSH keys of the clients that should be allowed to have access, and no password will be prompted.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.