I am trying to disable root password login and only allow root login with a ssh key on debian 7.

cat << EOF >> /etc/ssh/sshd_config
PasswordAuthentication yes
UsePAM no
PermitRootLogin without-password
AllowUsers root test
Port 433
LoginGraceTime 1m
ClientAliveInterval 600
ClientAliveCountMax 0
service ssh restart

I run these commands as part of a deployment script and yet still I am able to login as root afterwards using the root's password (and not using a ssh key).

I've read quite a few tutorials and I can't seem to see why this is happening.

| improve this question | | | | |

Have you checked the contents of '/etc/ssh/sshd_config'?

Your command does not rewrite this file, it appends to it. And the first line in this file (by default) is 'UsePAM yes'.

And this option will be used, as it comes earlier...

If you do not have a valid ssh key, the root will be asked for password in this case, because you have 'UsePAM yes' (http://www.techrepublic.com/blog/linux-and-open-source/specify-who-can-log-in-via-openssh/).

P.S. You command appends the config line to file every time you run it. You need either directly edit the sshd_config, or change your "deployment script" to rewrite it, instead of appending to it.

| improve this answer | | | | |
  • 1
    The option is only set when it first comes in the config file, but your link to Unix&Linux is about ssh_config, not sshd_config. The answer is correct but for different reasons. – Esa Jokinen Mar 14 '15 at 23:53
  • You are right, sorry for this mistake, I have edited my question and removed the misleading link. – Andrey Sapegin Mar 15 '15 at 18:17

You have to disable PasswordAuthentication and enable PermitRootLogin

like this:

PasswordAuthentication no
PermitRootLogin yes
| improve this answer | | | | |
  • In man sshd_conf it states "PermitRootLogin If this option is set to “without-password”, password authentication is disabled for root." – Paul Mar 14 '15 at 23:21
  • 3
    @Mohamed Magdy: This will disable password auth for the test user – Andrey Sapegin Mar 14 '15 at 23:22
  • I'm using it like I've stated and its working, see this: root@host1 [~]# grep -iE '^permit*|^passwordauthen*' /etc/ssh/sshd_config PermitRootLogin yes PasswordAuthentication no – Mohamed Magdy Mar 14 '15 at 23:22
  • BTW, I'm using CentOS – Mohamed Magdy Mar 14 '15 at 23:23

Not the answer you're looking for? Browse other questions tagged or ask your own question.