ssh login key question ..............

January 11, 2016 2.3k views
Security CentOS
finguanzo
By:
finguanzo

So, I add ssh key, good.
I can log in through ssh @root without password, great.

I keep reading about disabling root login for security, is this if you were not to set up an ssh key.?
If i disable root login, then my whole ssh key would be worthless correct,.?
I can create a second sudo account, disable root, but this second account would not be using the key, just the password I gave that account..

Is this correct.?

How do you all have accounts set up with ssh keys.?

Thank you,
Fidel

Log In to Comment
1 Answer
micalm January 11, 2016

From man sshd_config:

 PermitRootLogin
             Specifies whether root can log in using ssh(1).  The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”.  The default is “yes”.

             If this option is set to “without-password”, password authentication is disabled for root.

             If this option is set to “forced-commands-only”, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for tak‐
             ing remote backups even if root login is normally not allowed).  All other authentication methods are disabled for root.

             If this option is set to “no”, root is not allowed to log in.

You should not mistake permitting normal root login and root login through ssh.
As above, authentication via password via key are two different things, and do not affect each other.

If you set PermitRootLogin without-password in your SSH server config, you will be able to log in only via the key and not the password. Hovewer, most server admins do set up a separate account with sudo access and disable root login completely (PermitRootLogin no).

Reply
Have another answer? Share your knowledge.

Related