Question

Pam may bypass the setting of Set PermitRootLogin without-password

nano /etc/ssh/sshd_config

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

So how do I set this so PAM to not bypass “Set PermitRootLogin without-password” ?

Subscribe
Share

Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

With the default PAM settings, they shouldn’t interfere with the PermitRootLogin without-password. If you already have your SSH keys set up, you can test by renaming your private key (something like mv ~/.ssh/id_rsa ~/.ssh/diff_id_rsa) and it’ll prompt you for a password.

For a deeper look into PAM configuration, DO wrote this article