Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know it's possible to disallow root logins via ssh, and that it is a Good Idea™ to disallow root to ever login via ssh (preferring instead to use sudo or similar).

Is it possible to allow root to login only using keys, but to also allow su - to work from the commandline?

When I have disallowed root logins in the past, it has also killed the ability to do su - from another user.

If this is possible, how can I accomplish it?

share|improve this question
up vote 4 down vote accepted

Yes, it is possible. Put the following at the bottom of sshd_config:

Match User root
PasswordAuthentication no

You want to put this at the end of sshd_config, since everything after Match User root will apply only to root. See sshd_config for more details.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .