Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know it's possible to disallow root logins via ssh, and that it is a Good Idea™ to disallow root to ever login via ssh (preferring instead to use sudo or similar).

Is it possible to allow root to login only using keys, but to also allow su - to work from the commandline?

When I have disallowed root logins in the past, it has also killed the ability to do su - from another user.

If this is possible, how can I accomplish it?

share|improve this question
up vote 4 down vote accepted

Yes, it is possible. Put the following at the bottom of sshd_config:

Match User root
PasswordAuthentication no

You want to put this at the end of sshd_config, since everything after Match User root will apply only to root. See sshd_config for more details.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.