4

I am trying to disable root password login and only allow root login with a ssh key on debian 7.

cat << EOF >> /etc/ssh/sshd_config
PasswordAuthentication yes
UsePAM no
PermitRootLogin without-password
AllowUsers root test
Port 433
LoginGraceTime 1m
ClientAliveInterval 600
ClientAliveCountMax 0
EOF
service ssh restart

I run these commands as part of a deployment script and yet still I am able to login as root afterwards using the root's password (and not using a ssh key).

I've read quite a few tutorials and I can't seem to see why this is happening.

Improve this question
1

1 Answer 1

Reset to default
3

Have you checked the contents of '/etc/ssh/sshd_config'?

Your command does not rewrite this file, it appends to it. And the first line in this file (by default) is 'UsePAM yes'.

And this option will be used, as it comes earlier...

If you do not have a valid ssh key, the root will be asked for password in this case, because you have 'UsePAM yes' (http://www.techrepublic.com/blog/linux-and-open-source/specify-who-can-log-in-via-openssh/).

P.S. You command appends the config line to file every time you run it. You need either directly edit the sshd_config, or change your "deployment script" to rewrite it, instead of appending to it.

Improve this answer
2
  • 1
    The option is only set when it first comes in the config file, but your link to Unix&Linux is about ssh_config, not sshd_config. The answer is correct but for different reasons.
    – Esa Jokinen
    Commented Mar 14, 2015 at 23:53
  • You are right, sorry for this mistake, I have edited my question and removed the misleading link.
    – Andrey Sapegin
    Commented Mar 15, 2015 at 18:17

Not the answer you're looking for? Browse other questions tagged .