Is it possible (and if so, how) to do the following with openssh-server:

  • to be able to authenticate root user with a key and no password
  • to be able to authenticate a non-root user with a key and no password
  • to prevent the non-root user from logging in as root with his/hers own key
  • to do that with a single instance of sshd, using only one TCP port

And yes, I am very much aware of the risks of PermitRootLogin yes option.


This should work "out the box", and should require nothing further then putting users public keys in their .ssh/authorized_keys file for the corresponding user on the server. (If this file does not exist for the user, make it !)

The only thing to be aware of is that if the non-root user public key is added to the servers root/.ssh/authorized_keys, then that non-root user will be able to log in as root on the server - so to avoid this, just don't add their key to roots authorized_keys file.

You have already come across PermitRootLogin - which, of-course, needs to be enabled on the server. You can (optionally) limit who can log from where (if at all) by adding a line like "AllowUsers root@ip.address user1@ip.address user2" - which will only allow root and user1 from a particular IP address, but user2 can log in from anywhere. You can extend this with as many user/ip combinations as required.

  • Thank you! I didn't notice that, bacause the server was configured a bit weird (a single AuthorizedKeysFile in sshd_config, for all users) – Ulrik Oct 13 '17 at 1:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.