16

Our server cluster has remote root access enabled for rescue purposes, and we generally set PermitRootLogin prohibit-password in /etc/ssh/sshd_config because LDAP users can still login using password.

Recently we added an extra server with very strict access control, and we have PasswordAuthentication set to no so only specific users with SSH keys can login. However, a default setting of PermitRootLogin yes remained for some time unnoticed. (It wasn't a real issue since we also have the password of the root user deleted so no one could log in unless directly at the KVM console.)

My question is, with PasswordAuthentication no set, does PermitRootLogin yes behave identically to prohibit-password?

Improve this question

1 Answer 1

Reset to default
26

prohibit-password means authenticate with any allowed mechanism that is not password and not keyboardinteractive. See sshd_config PermitRootLogin

PasswordAuthentication no just means authenticate with any allowed mechanism that is not password, obviously. See sshd_config PasswordAuthentication

Therefore, the answer is no.

Also, prohibit-password is specific to the root account, PasswordAuthentication no is a global setting that affects all the accounts.

Note however, if you don't use keyboardinteractive, then the answer is yes (only considering the root account)

Improve this answer
2
  • What if i want to force Root user to login using the Password and Key both
    – Kashyap Patel
    Aug 11, 2021 at 10:47
  • @KashyapPatel PermitRootLogin Specifies whether root can log in using ssh(1). The argument must be yes, prohibit-password, forced-commands-only, or no. The default is prohibit-password. In your case it should be "yes"
    – Rahul Kadukar
    May 11, 2023 at 0:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .