Question

167

What does 'without password' mean in sshd_config file?

rated 0 times [ 167] [ 0] / answers: 1 / hits: 337222 / 3 Years ago, sat, july 10, 2021, 8:39:28

I just installed Ubuntu 14.04 on my server and I was setting up all my config files when I came across this in my sshd_config file:

# Authentication:

LoginGraceTime 120

PermitRootLogin without-password

StrictModes yes

This made me very worried. I thought that it was possible that someone could be logging into my server as root without a password.

I tried connecting to my server as root via:

johns-mbp:~ john$ ssh [email protected]

The authenticity of host '192.168.1.48 (192.168.1.48)' can't be established.

RSA key fingerprint is 40:7e:28:f1:a8:36:28:da:eb:6f:d2:d0:3f:4b:4b:fe.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added '192.168.1.48' (RSA) to the list of known hosts.

[email protected]'s password:

I entered a blank password and it didn't let me in, which was a relief. So my question is: what does without password mean and why is this a default in Ubuntu 14.04?

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

epypian

Add To Favorites

Follow

Total Points: 130

Total Questions: 111

Total Answers: 113

Location: Romania

Member since Mon, Jun 6, 2022

2 Years ago

answered 3 Years ago armis · Accepted Answer

From the man page:

PermitRootLogin

Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or "no”. The default is “yes”.

If this option is set to prohibit-password (or its deprecated alias, without-password), password and keyboard-interactive authentication are disabled for root.

If this option is set to “forced-commands-only”, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for taking remote backups even if root login is normally not allowed). All other authentication methods are disabled for root.

If this option is set to “no”, root is not allowed to log in.

Thus, prohibit-password allows root login only with public key authentication. This is often used with shell scripts and automated tasks.