Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I know it's possible to disallow root logins via ssh, and that it is a Good Idea™ to disallow root to ever login via ssh (preferring instead to use sudo or similar).

Is it possible to allow root to login only using keys, but to also allow su - to work from the commandline?

When I have disallowed root logins in the past, it has also killed the ability to do su - from another user.

If this is possible, how can I accomplish it?

share|improve this question
add comment

1 Answer

up vote 4 down vote accepted

Yes, it is possible. Put the following at the bottom of sshd_config:

Match User root
PasswordAuthentication no

You want to put this at the end of sshd_config, since everything after Match User root will apply only to root. See sshd_config for more details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.