Ssh – Permit root to login via ssh only with key-based authentication

authenticationssh

I have some doubts about certain ssh server configurations on /etc/ssh/sshd_config. I want the next behavior:

  1. Public key authentication is the only way to authenticate as root (no password authentication or other)
  2. Normal users can use both (password and public key authentication)

If I set PasswordAuthentication no my first point is satisfied but not the second. There is a way to set PasswordAuthentication no only for root?

Best Answer

You can do this using the PermitRootLogin directive. From the sshd_config manpage:

Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”. The default is “yes”.

If this option is set to “without-password”, password authentication is disabled for root.

The following will accomplish what you want:

PasswordAuthentication yes
PermitRootLogin without-password
Related Question