Changing PermitRootLogin does not, by itself, make root logins work. OpenSSH evaluates that setting together with the authentication method, included configuration files, conditional Match rules, account restrictions, and PAM. A reliable fix is to keep your current session open, inspect the effective configuration with sshd -T, validate syntax with sshd -t, then test a second connection before disconnecting.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
For most VPS administration, the safest design is a named account with sudo and PermitRootLogin no. If direct root access is an unavoidable operational requirement, use a public key with PermitRootLogin prohibit-password rather than enabling root passwords.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What PermitRootLogin actually controls
PermitRootLogin controls whether the root account may authenticate through SSH and, if so, which root authentication methods are accepted. It is not a master switch for every SSH login. A root attempt can still fail because password authentication is disabled globally, a key is missing or rejected, an AuthenticationMethods rule requires multiple methods, or an account policy blocks the user.
| Value | Root authentication behavior | Typical use |
|---|---|---|
yes |
Allows root login using authentication methods that are enabled elsewhere, including a password if password authentication is enabled. | Temporary or tightly controlled situations; broadest direct-root exposure. |
prohibit-password |
Disables root password and keyboard-interactive authentication while allowing other methods, such as public-key authentication. Ubuntu documents without-password as a deprecated alias. |
Direct root access when key-only login is operationally required. |
forced-commands-only |
Allows root login only for keys that specify a forced command. Ordinary interactive root sessions are not permitted. | Automation or a narrowly scoped key that must run one command. |
no |
Disallows root login through SSH. | Recommended baseline when administrators can use a named account with sudo. |
The setting does not create a root password, install a key, or override another rule. Think of it as one gate in a chain: the root account must first be allowed, then the selected authentication method must be enabled and accepted, and finally any user, host, PAM, or account restrictions must pass.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Why SSH still rejects root after you change the setting
Password authentication is a separate gate
With PermitRootLogin prohibit-password, root passwords and keyboard-interactive authentication are intentionally disabled. Entering the correct root password will still produce an authentication failure. Even with PermitRootLogin yes, a global PasswordAuthentication no prevents password login for root and other users.
Keyboard-interactive authentication has its own controls. Depending on the OpenSSH version and distribution configuration, inspect KbdInteractiveAuthentication and the deprecated ChallengeResponseAuthentication name. A password prompt supplied through PAM can be keyboard-interactive rather than the password method you expected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The active file may not be the file you edited
Ubuntu’s default /etc/ssh/sshd_config includes /etc/ssh/sshd_config.d/*.conf near the top. A snippet in that directory can therefore provide a value you did not notice in the main file. Images assembled by cloud-init or a VPS provider may add their own snippets.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
OpenSSH reads configuration in order, and conditional Match blocks can apply a different value for a particular user, host, or source address. A line that looks correct outside a Match block may not be the effective rule for your connection. Never assume a commented example or a distribution default describes the running daemon.
Another authentication or account policy is failing
Inspect these controls as a group:
PubkeyAuthentication, which controls public-key authentication.AuthenticationMethods, which can require methods in sequence, such as a key followed by another factor. Enabling passwords does not satisfy a rule that requires a different method first.AllowUsersandDenyUsers, which can explicitly permit or block root.- PAM policies, locked or expired accounts, shell restrictions, and other account-level controls.
If the client offers a password but the server requires a key, or if root is denied by an allow/deny rule, changing only PermitRootLogin cannot fix the connection.
Use a safe diagnostic workflow
Do not experiment from the only session that can reach the VPS. Complete the following sequence so a bad edit does not become a lockout.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
- Keep the current session open. Do not close a working SSH window until a new connection has succeeded. Establish a second administrative path first: an existing non-root account with
sudo, the VPS provider’s web console, or another out-of-band console. - Inventory configuration sources. Read the main file and every included snippet. For example, inspect
/etc/ssh/sshd_configand list the files under/etc/ssh/sshd_config.d/. Search all of them for the relevant directives rather than looking only for the first visiblePermitRootLoginline. - Search the complete set of gates. Check
PermitRootLogin,PasswordAuthentication,KbdInteractiveAuthenticationorChallengeResponseAuthentication,PubkeyAuthentication,AuthenticationMethods,AllowUsers,DenyUsers, and account or PAM restrictions. Include the contents of any applicableMatchblock. - Check syntax before applying anything. Run
sudo sshd -t. If the daemon uses a non-default file, specify it explicitly, for examplesudo sshd -t -f /path/to/sshd_config. No output normally means the syntax check passed; an error identifies a line that must be corrected before reload. - Inspect the daemon’s effective values. Run:
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|authenticationmethods'
This output reflects the parsed global configuration, not merely what appears in one file. - Evaluate conditional rules for the real connection. Supply the intended user, server host name, and client address. A useful pattern is:
sudo sshd -T -C user=root,host=$(hostname),addr=CLIENT_IP | grep permitrootlogin
ReplaceCLIENT_IPwith the address from which you will connect. This matters when aMatch User,Match Address, or similar condition changes the result. - Choose the least-permissive correction. Prefer
PermitRootLogin noand administer through a named sudo account. If direct root access is required, useprohibit-passwordwith a tested public key. Do not enable root passwords merely because a key has not yet been installed. - Reload only after validation, then test separately. On systems using the usual service name, run
sudo systemctl reload ssh; use the service name provided by your distribution if it differs. Open a second terminal and test the exact authentication method you intend to support. Keep the original session until that test succeeds.
Fix the common failure scenarios
“I need root password login, but the password is rejected”
First determine whether password login is actually the requirement. If you can use a key, change the root policy to PermitRootLogin prohibit-password and install the key instead of exposing a root password.
If a password is unavoidable, all relevant gates must permit it: the effective PermitRootLogin must be yes, PasswordAuthentication must be enabled, keyboard-interactive settings must not be the only path you are testing, and no AuthenticationMethods, allow/deny rule, PAM policy, or account lock must block root. Validate with sshd -T and the conditional -C form before reloading.
“I set PermitRootLogin yes, but root still cannot log in with a key”
Confirm that public-key authentication is enabled and that the key is in the root account’s authorized-key file: /root/.ssh/authorized_keys. Check that the file and its parent directory are owned by root and have restrictive permissions accepted by the SSH daemon. Make sure the client is offering the intended private key; run the connection with verbose diagnostics, for example ssh -vvv root@server, and look for whether the key is offered, accepted, or refused.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
A key can be valid yet still fail because an AllowUsers rule excludes root, an AuthenticationMethods chain requires another factor, the account shell is restricted, or a Match rule changes PubkeyAuthentication. Compare the effective server output with the client’s verbose log rather than repeatedly changing the root directive.
“The key works only for a command, not an interactive shell”
That behavior is consistent with PermitRootLogin forced-commands-only. This mode permits root keys only when a forced command is attached to the key entry. It is suitable for automation that must run one operation, not for an administrator who expects an interactive shell. Use prohibit-password for key-only interactive root access, or use a named sudo account for routine administration.
“My edit was accepted, but the old behavior remains”
A successful editor save does not prove that the daemon loaded the file. Run sudo sshd -t, inspect sudo sshd -T, and verify that you reloaded the service after the edit. Then search included snippets and conditional blocks for a competing directive. If the daemon is started with a custom configuration path, validate and reload that path rather than the default file.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Install and verify a root key safely
When the policy is key-only, the public key must be present for the root account before you close your existing session.
- From your working administrative account, create or copy the intended public key into
/root/.ssh/authorized_keys. Ubuntu documents this file as the authorized-key location for account access. - Verify that
/root/.sshandauthorized_keysbelong to root and are not writable by unrelated users. Correct ownership and restrictive permissions if necessary. - Confirm
PubkeyAuthentication yesin the effective configuration and check that noMatchrule disables it for root. - Set
PermitRootLogin prohibit-password, runsudo sshd -t, and inspect the effective values. - Reload the SSH service and open a new terminal that explicitly uses the matching private key. Do not terminate the original session until the new root-key login reaches the expected shell or command.
Read the logs when configuration looks correct
Server-side logs identify the rejection reason that a generic client message hides. Review the SSH service journal with a command such as journalctl -u ssh or the unit name used by the distribution, commonly sshd. Look for messages about an invalid user, a denied authentication method, bad ownership or permissions, a refused key, a failed PAM check, or a disallowed account.
On the client, ssh -vvv shows which methods are offered and in what order. Compare that sequence with AuthenticationMethods. For example, a server requiring a public key first will reject a password even when PasswordAuthentication yes appears in the effective output.
Recover if a change locks out SSH
Leave an existing session open whenever possible. If every new connection fails, use the second sudo account or the VPS provider console to revert the last change. Run sshd -t before reloading again. If you cannot identify the issue from the journal, restore a known-good configuration, reload, and then make one controlled change at a time while testing from a second terminal.
Do not reboot as a first response: a reboot does not repair a syntax error or an authentication policy and can remove your only active session. Console access is especially important when a cloud-init snippet or an included file keeps reapplying an unwanted setting.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose a secure operating model
| Operating model | Authentication path | Blast radius | Recoverability requirement |
|---|---|---|---|
| Named administrator with sudo | User key or other approved method; root SSH disabled with PermitRootLogin no. |
Lower: routine sessions do not authenticate directly as root. | Maintain a second sudo-capable session or console while changing SSH policy. |
| Direct root, key only | Public key with PermitRootLogin prohibit-password; password and keyboard-interactive root login disabled. |
Higher than sudo because a stolen key reaches root directly. | Keep a tested alternate key, sudo account, or console path. |
| Automation key with forced command | Root key tied to a forced command under PermitRootLogin forced-commands-only. |
Constrained to the command attached to the key, but still requires careful key protection. | Retain a separate administrative path; the automation key is not an interactive fallback. |
| Direct root password | PermitRootLogin yes plus enabled password authentication. |
Broadest exposure and the least desirable baseline. | Console access is strongly advisable before enabling it. |
Red Hat’s RHEL 9 network-hardening guidance lists PermitRootLogin no as the hardening control. Ubuntu and Debian OpenSSH manuals describe prohibit-password as the key-only alternative when an operational requirement exists. Defaults vary by image and release, so the value reported by sshd -T on the actual VPS is authoritative.
Quick Recap
Quick symptom-to-check map
| Symptom | First checks | Likely correction |
|---|---|---|
| Root password is rejected immediately | Effective PermitRootLogin, PasswordAuthentication, keyboard-interactive settings, and AuthenticationMethods. |
Use a key with prohibit-password, or deliberately enable every required password gate only when the risk is accepted. |
| Root key is never offered | Client ssh -vvv output and the private-key selection. |
Specify the intended key and verify the server has its matching public key. |
| Root key is offered but refused | /root/.ssh/authorized_keys, ownership and permissions, PubkeyAuthentication, allow/deny rules, and logs. |
Correct the key file or the rule that rejects root. |
| Configuration test fails | Exact line reported by sudo sshd -t; custom -f path if applicable. |
Fix syntax before any reload. |
| Global output looks right but one source address fails | sshd -T -C user=root,host=$(hostname),addr=CLIENT_IP and relevant Match blocks. |
Adjust the conditional rule or connect from an address it permits. |
| Reload succeeds but behavior does not change | Service name, daemon configuration path, included snippets, and effective output. | Reload the daemon that actually serves SSH and remove or edit the competing source. |
A repeatable checklist
- Keep the working session open.
- Confirm a second sudo or console path.
- Inspect the main file, included snippets, and
Matchblocks. - Check all authentication and account gates, not just
PermitRootLogin. - Run
sudo sshd -t. - Inspect global and conditional effective values with
sshd -T. - Install and verify a key before selecting
prohibit-password. - Reload the correct service only after validation.
- Test from a second terminal.
- Use server journal entries and
ssh -vvvto resolve remaining failures.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
