Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use ~/.ssh/config file so that I can easily enter ssh myserver and it'll provide the correct username, port, hostname, identity file, etc.

However for many servers, the first thing I do is enter su - to log in as root. I can do this all in one command on the command line like so: ssh myserver -t su -. Is there something I can add to my ~/.ssh/config file that'll do that for me? I want to be able to do ssh myserver-root and it'll do the same thing as ssh myserver -t su -?

I know about PermitRootLogin, that's off for this server, and I'm reluctant to turn that on. I'd much rather see if there's a way to do this using ssh on the client side.

share|improve this question
up vote 10 down vote accepted

I think I'd approach this from the other direction - use 'command=' on the public key entry in your ~/.ssh/authorized_keys file on the remote server, to run your "su -" command.

Then just use/reference the private key in your ~/.ssh/config file (IdentityFile option) for every host/alias ("myserver-root") you want to work this way.

The options available in authorized_keys(5) are documented in sshd(8).

share|improve this answer
Yes that does exactly what I want. :) I have full control over the ~/.ssh/authorized_key file on the server and have no problem with changing that. – Rory Aug 20 '09 at 11:00

Why not add a script to a dir in your path (or an alias for it) called rssh like:

ssh $1 -t 'su -'

Then it is just:

rssh myServer
share|improve this answer

I did not find any config option for pseudo-tty allocation in the OpenSSH source.

But I can give a tip regarding PermitRootLogin, Set it to:

PermitRootLogin without-password

And allow only root logins with ssh-keys.

share|improve this answer

How about adding something like this in ~/.bashrc on the server side?

if [ "$SSH_TTY" != "" ]; then su -; logout; fi
share|improve this answer

The best answer is probably a combination of rkthkr and jrg. Use PermitRootLogin to require a key, then only put the key with the command keyword in root's authorized_keys file.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.