I have some doubts about certain ssh server configurations on /etc/ssh/sshd_config. I want the next behavior:
If I set PasswordAuthentication no my first point is satisfied but not the second. There is a way to set PasswordAuthentication no only for root?
You can do this using the PermitRootLogin directive. From the sshd_config manpage:
Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or “no”. The default is “yes”.
If this option is set to “without-password”, password authentication is disabled for root.
The following will accomplish what you want:
PasswordAuthentication yes
PermitRootLogin prohibit-password
PermitRootLogin now accepts an argument of 'prohibit-password' as a less-ambiguous synonym of 'without-password'.
Then reload your ssh server:
systemctl reload sshd
As usual, don't close your active terminal until you verified, from another terminal, that everything works and that you are not locked out by a mistake.
service ssh restart on the server and then on the client I tried connecting without my key with ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no root@host and indeed could not login with password but could with key for the root user.
ssh -o PreferredAuthentications=password root@host not particularly secure imho
You can use Match blocks to configure some options per user or group authenticating or per IP address or host name of the origin of the connection.
PasswordAuthentication yes
PermitRootLogin yes
Match User root
PasswordAuthentication no
Then reload your ssh server:
systemctl reload sshd
As usual, don't close your active terminal until you verified, from another terminal, that everything works and that you are not locked out by a mistake.
I have an even more restrictive approach to grant root privileges on my server, which might be interesting for the paranoid ones like me. Be careful what you do and in which order, otherwise you might end up with a system you can't get root access on.
sugroup, whos members will be allowed to become root and only allow key authentication for this group by putting the following lines at the end of sshd_confid:Match Group sugroup
PasswordAuthentication no
auth required pam_wheel.so group=sugroup in /etc/pam.d/su. It might be already there and you just have to uncomment it. This denies root access to all users not member of sugroupPermitRootLogin no in /etc/ssh/sshd_config.Using this configuration it is necessary to use a key authentication and a password to become root. I configured my server like this, since I prefer having no direct root access via ssh, regardless of the authentication method.
Beware, that current Debian (12 and 11) and possibly other systems, which incorporate config file plugin system, having config for sshd like this in sshd_config:
# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented. Uncommented options override the
# default value.
Include /etc/ssh/sshd_config.d/*.conf
...
PermitRootLogin yes
...
and custom config in /etc/ssh/sshd_config.d/my.conf
PermitRootLogin prohibit-password
Will result in allowed password, since sshd_config will override setting.
Tested, thus warning.
Special note on this, because some systems, e.g. Proxmox will write down value explicitly in sshd_config file, and if you are managing custom configs with configuration management tool like Ansible, it will be false positive configuration.
If you set PermitRootLogin no
You can't use a [root] username to login a server via any type of auth (ssh keys/password)
/root/.ssh/authorized_keys.