I am implementing a basic deploy script and for sshd_config the only change that I need to make is PermitRootLogin yes to PermitRootLogin without-password. I have read through the docs and they make no mention of this but that is not to say it is impossible.

Can I specify a second PermitRootLogin? I.e. echo 'PermitRootLogin without-password' >> /etc/ssh/sshd_config

If so, is this safe?

Updates based on comments:

1) I am aware that I could parse the file and change the variable. My question still remains though.

  • 1
    This is why we have things like sed, or for more complexity, augeas. Mar 4, 2015 at 15:46
  • Michael you are right. But its not what I am asking. I will update my question to specify that I am aware of parsing the file and changing the config.
    – Ne Ma
    Mar 4, 2015 at 15:48

4 Answers 4



You could simply test this by adding the line and checking whether you can log in. Then you could comment out the first occurrence, restart the service and test again.

Reason: OpenSSH servconf.c has function

  • process_server_config_line() on lines 1200-2171 (for 7.9p1)
  • refactored to call process_server_config_line_depth() on lines 1260-2371 (for 8.3p1).

All global directives are processed only at startup and global directives are only processed once. The setting will stay as it was on the first occurrence.

On the other hand using the same directive twice may lead to misunderstanding.

Please reconsider parsing the file. You could also replace the whole file, if applicable.

  • Cheers Esa augtools allows me an easy option, but I was more curious as to wether this is safe or not.
    – Ne Ma
    Mar 4, 2015 at 17:08

TL;DR Yes Debian and derivatives support early include files.

Debian and Ubuntu have "Include" directives early in ssh and sshd configuration files:

/etc/ssh/ssh_config:19:Include /etc/ssh/ssh_config.d/*.conf
/etc/ssh/sshd_config:13:Include /etc/ssh/sshd_config.d/*.conf

I agree with prior answers, first value found prevails where Include directory files are processed first.

echo PermitRootLogin without-password > /etc/ssh/sshd_config.d/PermitRootLogin.conf

No, most settings will only use the first value it comes across; the X11Forwarding setting is an easy one to test this with. That being said, you might be able to take advantage of the per-user override settings to allow the same thing. These are normally tagged onto the bottom and so would work better with your goal of appending.

That being said, as the others mentioned sed would be a much cleaner solution.

sed -i 's/PermitRootLogin yes/PermitRootLogin without-password/g' /etc/ssh/sshd_config

Amending previous answers. As of now, the manual for sshd_config file starts with "For each keyword, the first obtained value will be used". Thus, as others have already written, duplicates are ignored.

It is possible to use a Match block to override global settings based on a condition. The PermitRootLogin is among the keywords allowed in a Match block.

(I came to this question as the default configuration of sshd in the OS I am using was changed to use an Include directive + glob pattern, moving vendor defaults into a separate file. Thus it is important to know how sshd handles the duplicate keywords, so that I could override the defaults.)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .