5

I am implementing a basic deploy script and for sshd_config the only change that I need to make is PermitRootLogin yes to PermitRootLogin without-password. I have read through the docs and they make no mention of this but that is not to say it is impossible.

Can I specify a second PermitRootLogin? I.e. echo 'PermitRootLogin without-password' >> /etc/ssh/sshd_config

If so, is this safe?

Updates based on comments:

1) I am aware that I could parse the file and change the variable. My question still remains though.

  • 1
    This is why we have things like sed, or for more complexity, augeas. – Michael Hampton Mar 4 '15 at 15:46
  • Michael you are right. But its not what I am asking. I will update my question to specify that I am aware of parsing the file and changing the config. – Neil Masters Mar 4 '15 at 15:48
10

No.

You could simply test this by adding the line and checking whether you can log in. Then you could comment out the first occurrence, restart the service and test again.

Reason: OpenSSH servconf.c has function process_server_config_line() on lines 991-1905 (for 7.6p1). All global directives are processed only at startup and global directives are only processed once. The setting will stay as it was on the first occurrence.

On the other hand using the same directive twice may lead to misunderstanding.

Please reconsider parsing the file. You could also replace the whole file, if applicable.

  • Cheers Esa augtools allows me an easy option, but I was more curious as to wether this is safe or not. – Neil Masters Mar 4 '15 at 17:08
1

No, most settings will only use the first value it comes across; the X11Forwarding setting is an easy one to test this with. That being said, you might be able to take advantage of the per-user override settings to allow the same thing. These are normally tagged onto the bottom and so would work better with your goal of appending.

That being said, as the others mentioned sed would be a much cleaner solution.

sed -i 's/PermitRootLogin yes/PermitRootLogin without-password/g' /etc/ssh/sshd_config

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.