The man page states that PermitRootLogin

Specifies whether root can log in using ssh(1).

However, it is not clear if this check is based on the user name ("root") or the UID (0).

What happens if the root account is renamed to "admin"? Will "admin" be able to log in when PermitRootLogin=no?

What happens if there are two accounts with UID=0, i.e. "root" and "admin"? Will either of them be able to login?

2 Answers 2


It seems the check is done on UID (tested on OpenSSH_6.7p1 Debian-5+deb8u3, OpenSSL 1.0.1t 3 May 2016):

Set PermitRootLogin off:

mtak@pdv1:~$ grep PermitRootLogin /etc/ssh/sshd_config
PermitRootLogin no

Make sure a user named admin is created with UID 0:

mtak@pdv1:~$ sudo grep admin /etc/passwd
admin:x:0:0:Root User:/root:/bin/bash

Make sure the user can be used to log on to the system:

mtak@pdv1:~$ su - admin

Check if we can log on to the system using SSH:

mtak@rubiks:~$ ssh admin@pdv1
admin@pdv1's password: 
Permission denied, please try again.

If we turn PermitRootLogin on:

mtak@pdv1:~$ grep PermitRootLogin /etc/ssh/sshd_config
PermitRootLogin yes

And try to log on:

mtak@rubiks:~$ ssh admin@pdv1
admin@pdv1's password: 
Linux pdv1 4.4.8-1-pve #1 SMP Tue May 17 16:14:08 CEST 2016 x86_64
Last login: Wed Aug 24 12:05:28 2016 from xxx
  • Interesting that even though UID 0 has the username admin, it still shows up as root@pdv1 in the shell
    – Dezza
    Aug 25, 2016 at 10:13
  • 1
    @Dezza Possibly depends on the order lines are listed in /etc/passwd (as in: find the first entry with UID=0).
    – TripeHound
    Aug 25, 2016 at 12:00

I appreciate the approach of @mtak in the other answer, but the answer is obvious even without this trials.

It is based on the UID, as you can see in the source code of openssh:

if (authctxt->pw->pw_uid == 0 &&
authenticated = 0;

Also every authentication method shows something like

if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
    ok = 0;

grep-ing further in the code, you may notice, there is no strcmp('root', pw->pw_name) or some alternative, if it will be enough for you.

  • How do you know sshd checks for UID 0? You're not using any argumentation to support your statement.
    – mtak
    Aug 24, 2016 at 14:19
  • 2
    Unix defines a superuser by its UID=0. As another example can be a source code of openssh.
    – Jakuje
    Aug 24, 2016 at 14:24
  • The kernel does, but you were assuming OpenSSH did as well. For example, Apache basic authentication doesn't allow root login as well, does it? Thank you for the link, I've modified your answer to include that.
    – mtak
    Aug 24, 2016 at 14:27
  • 1
    If it would do it some other way, it would be a potential security risk.
    – Jakuje
    Aug 24, 2016 at 14:28
  • 3
    @Bakuriu and why it would create the pw context from something else. The openssh code is open source and interested readers can go through the whole code. Similar constructions are all over the code for every authentication method. If you grep through the code, you will never find strcmp('root', pw->pw_name), if it will make it more reliable for you.
    – Jakuje
    Aug 24, 2016 at 15:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .