What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If SSH rejects a root login after you changed PermitRootLogin, that setting is only one authentication gate. The daemon may be reading an included snippet or a conditional Match block, root passwords may still be disabled by prohibit-password, or another control such as AuthenticationMethods, AllowUsers, PAM, or account state may be blocking the attempt.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Keep your current session open, obtain a second administrative path, inspect the daemon’s effective configuration with sshd -T, validate it with sshd -t, and test a new connection before ending the original session. The procedure below distinguishes password, key, and forced-command access so you can fix the actual gate without locking yourself out.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
What PermitRootLogin actually controls
PermitRootLogin controls whether the account named root may authenticate through SSH and, when it is allowed, which root authentication methods are accepted. It does not turn SSH authentication on by itself. A root login still has to pass the selected authentication method, any method sequencing, account and PAM checks, and user or address restrictions.
| Value | Root access permitted | Authentication behavior | Typical use |
|---|---|---|---|
yes |
Yes | Root may use the authentication methods otherwise enabled for SSH, including a password when password and account checks allow it. | Only when a documented operational requirement demands direct root access and the additional risk is accepted. |
prohibit-password |
Yes | Root password and keyboard-interactive authentication are disabled. Other methods, such as a public key, can still work. | Key-only root access when a named sudo account cannot perform the required operation. |
without-password |
Yes | Deprecated alias for prohibit-password; password and keyboard-interactive authentication are disabled. |
Recognizing an older configuration; use the current spelling when changing a setting. |
forced-commands-only |
Limited | Root keys are accepted only when the key entry has a forced command. It is not a general interactive root login. | Restricted automation that must run one predetermined command. |
no |
No | SSH refuses root login regardless of whether a root password or key is otherwise valid. | Normal administration through a named account with sudo. |
The important consequence is that setting PermitRootLogin yes does not guarantee that a root password will work, and setting PermitRootLogin prohibit-password intentionally makes a correct root password fail. In Ubuntu and Debian OpenSSH documentation, “password” in this context includes keyboard-interactive authentication.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Why a changed value may appear to have no effect
Included snippets can be active
Ubuntu’s default /etc/ssh/sshd_config includes /etc/ssh/sshd_config.d/*.conf near the top of the file. A setting in one of those snippets can be the value the daemon uses, even when the main file contains a different, commented, or later-looking line. VPS images and cloud-init packages can install or modify snippets during provisioning. Inspect the main file and every matching file in the include directory rather than editing only the first line you find.
Match blocks can change the answer for one connection
A Match block applies settings only when its user, host, address, or other condition matches. The value for an ordinary test account can therefore differ from the value for root connecting from your client address. Use the conditional form of sshd -T with the actual user, server host name, and client IP to see the result for that connection.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOther controls can reject root independently
Search all of these controls in the main file and snippets:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
PasswordAuthenticationKbdInteractiveAuthenticationand its older name,ChallengeResponseAuthenticationPubkeyAuthenticationAuthenticationMethodsAllowUsersandDenyUsers- Account state, password expiry, login shells, and PAM restrictions
AuthenticationMethods can require methods in sequence. For example, enabling password authentication does not help if the effective policy also requires a public key first. Conversely, a valid key can still be rejected if the policy requires a second method that root is not allowed to use.
Safe diagnostic workflow before changing anything
- Keep the current SSH connection open. Do not close the session in which you still have administrative access.
- Establish a second recovery path. Use an existing sudo-capable account in another terminal, or open the VPS provider’s serial, web, or emergency console. If a change fails, this path is how you undo it.
- Inventory configuration sources. Read
/etc/ssh/sshd_config, list the files under/etc/ssh/sshd_config.d/, and inspect any snippets referenced by anIncludedirective. Search for every control listed above, including lines insideMatchblocks. - Check the daemon’s syntax before reloading. Run
sudo sshd -t. If the VPS uses a non-default file, specify it withsudo sshd -t -f /path/to/sshd_config. A successful command produces no error output; a reported line number must be fixed before you reload. - Inspect effective global values. Run
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|authenticationmethods'. This output reflects the parsed configuration rather than a commented example line. - Inspect the conditional result. Substitute the real client address in
sudo sshd -T -C user=root,host=$(hostname),addr=CLIENT_IP | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|authenticationmethods'. This catches aMatchrule that applies only to your root connection. - Compare the requested method with the policy. A password attempt needs an effective
PermitRootLogin yes, password or keyboard-interactive authentication enabled, and no account or PAM rejection. A key attempt needs a root-allowed mode, public-key authentication enabled, and a usable key in root’s authorized-key file. - Change the narrowest setting that solves the requirement. Edit the file that supplies the effective value, not an unrelated commented line. Keep the recovery session open while you validate and apply the change.
Choose the least-permissive fix
Normal administration: disable direct root SSH
For routine server management, set PermitRootLogin no and connect with a named account that has the required sudo privileges. This separates individual administrator activity from the shared root identity and reduces the impact of a stolen credential. Confirm that the named account works in a second terminal before applying the change.
Key-only root access: use prohibit-password
When a process genuinely requires direct root SSH, PermitRootLogin prohibit-password allows public-key authentication while rejecting root passwords and keyboard-interactive prompts. This is the preferred direct-root compromise documented by Ubuntu and Debian manuals: the root password is not an SSH entry path, but a specifically installed key can still be used.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Make sure the key is ready before reloading. The public key belongs in /root/.ssh/authorized_keys. Confirm that the file and its parent directory are owned by root, have restrictive permissions appropriate for the distribution, and contain the complete, unwrapped public-key line. Also confirm that the effective configuration has PubkeyAuthentication yes. A key copied to a non-root user’s home directory cannot authenticate as root.
Forced-command automation: use forced-commands-only
This mode is intentionally narrower than interactive key-only access. Root keys work only when the corresponding authorized-key entry attaches a forced command. It is suitable for a job that must invoke one predetermined operation, not for a shell, troubleshooting session, or general administration. Test the exact command and its exit behavior before relying on it for automation.
Root password access: understand the extra gates
If an emergency procedure requires a root password, the effective root policy must be yes, not prohibit-password or forced-commands-only. PasswordAuthentication must permit password authentication, and a keyboard-interactive-only setup may instead require KbdInteractiveAuthentication. Check AuthenticationMethods for a required key or second factor. Finally, verify that the root account is not locked, expired, denied by PAM, excluded by AllowUsers, or included in DenyUsers. Re-enable the more restrictive policy as soon as the emergency task is complete.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
How to install and verify a root SSH key
- Use your existing administrative path to create or inspect
/root/.ssh. - Place the client’s public key, as one complete line, in
/root/.ssh/authorized_keys. - Check that root owns the directory, file, and key material and that permissions are restrictive enough for SSH’s ownership and mode checks.
- Confirm with
sudo sshd -T(and the conditional form when needed) thatpermitrootlogin prohibit-passwordoryesis effective and thatpubkeyauthentication yesis present. - From a second terminal, specify the intended private key explicitly, for example
ssh -i /path/to/private_key root@SERVER. Do not remove the original session until this connection reaches a shell or performs the intended forced command.
If the key attempt fails, run the client with ssh -vvv. The verbose trace shows whether the client offered the expected key, whether the server accepted it, and at which authentication stage the exchange stopped. Server-side messages are available through journalctl -u ssh or journalctl -u sshd, depending on the distribution’s service name.
Validate, reload, and test without locking yourself out
- Run
sudo sshd -tagainst the file the service actually uses. Fix every syntax error first. - Run
sudo sshd -Tand, if a conditional rule is possible,sudo sshd -T -C user=root,host=$(hostname),addr=CLIENT_IP. Record the values for the authentication controls relevant to your test. - Reload rather than stopping the daemon:
sudo systemctl reload ssh, or the service name used by your distribution. A reload lets existing sessions continue while new connections use the parsed configuration. - Open a new terminal and test the exact account and method you intend to use. Test both success and expected rejection: for example, a key should succeed under
prohibit-password, while a root password should fail by design. - Only after the second path works should you close the original session. Keep the provider console available until the change has been stable through at least one fresh connection.
Common symptoms and the precise branch to investigate
“Permission denied” after entering the correct root password
First inspect PermitRootLogin. If it is prohibit-password or its deprecated alias, the rejection is expected. If it is yes, inspect PasswordAuthentication, KbdInteractiveAuthentication, AuthenticationMethods, account lock or expiry state, PAM rules, and user allow/deny lists. The client’s ssh -vvv output and the server journal identify whether the failure occurred before or after password verification.
“Permission denied” with a key under prohibit-password
Confirm that the public key is in /root/.ssh/authorized_keys, not only in the sudo user’s file. Check root ownership and restrictive permissions, verify the key is complete, and ensure PubkeyAuthentication yes is effective for the connection. Then run ssh -vvv to confirm that the client offers the matching private key.
The file shows yes, but sshd -T reports another value
An included snippet or a conditional rule is supplying the effective setting. Search every file named by Include, inspect Match blocks, and repeat the conditional sshd -T -C command with the real root user, host, and client address. Edit the source that actually produces the effective value, then validate again.
The daemon will not reload after an edit
Run sudo sshd -t and read the reported file and line number. Typical causes are a misspelled keyword, an invalid value, a malformed Match condition, or an included snippet that is not valid for the installed OpenSSH version. Restore the last known-good text from the still-open session or use the provider console, test again, and reload only after syntax validation succeeds.
A normal user can connect, but root cannot
This is consistent with PermitRootLogin no or a root-specific Match rule. Compare the global and conditional outputs. Also check root-specific account and PAM restrictions; a successful named-user login does not prove that root is permitted.
Distribution and image considerations
Red Hat’s RHEL 9 network-hardening guidance lists PermitRootLogin: no as the hardened control. Ubuntu and Debian documentation describe prohibit-password as the key-only alternative when direct root access is required. The default files, service names, cloud-init snippets, and OpenSSH releases vary by image and release, so a commented line in a vendor template is not authoritative. The effective output from the VPS’s own sshd -T command is the value to trust.
Do not assume that changing the root password, restarting the VPS, or editing only /etc/ssh/sshd_config changes the SSH policy. Authentication is evaluated by the running daemon’s parsed configuration and by the account and PAM stack. Treat every image-specific snippet and every conditional rule as part of the policy you must inspect.
Quick Recap
A decision framework for comparing possible fixes
| Decision axis | Named sudo user | Root with a key | Root with a password | Forced-command root key |
|---|---|---|---|---|
| Authentication method | User key or password, subject to policy | Public key | Password or keyboard-interactive, if enabled | Public key plus an attached forced command |
| Blast radius | Commands can be audited and elevated explicitly | Direct root authority if the key is compromised | Direct root authority and password exposure | Limited to the command attached to the key |
| Configuration scope to inspect | User and global authentication settings | Root policy, public-key settings, authorized keys | Root policy, password settings, method sequencing, PAM | Root policy, public-key settings, forced command |
| Recoverability | High when another sudo path exists | High if a second key or console remains available | Depends on preserving a console or separate administrator | Depends on the automation path and console access |
| Verification quality | sshd -t, effective values, fresh login |
The same checks plus a real key login | The same checks plus a password test and journal review | The same checks plus verification that only the forced command runs |
Prevent the next lockout
- Keep one existing administrative session open while editing SSH configuration.
- Maintain a second sudo account or tested provider console before changing root access.
- Use configuration management to track edits to the main file and included snippets.
- Run
sshd -tas a deployment check and inspect effective values after templating. - Test the exact user, source address, and method with a new connection before terminating old sessions.
- Prefer
PermitRootLogin no; where a requirement makes direct root unavoidable, use key-onlyprohibit-passwordand keep the key lifecycle controlled.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
