Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to configure a machine so software installation can be automated remotely via SSH. Following the wiki, I was able to setup SSH keys so my user can access the machine without a password, but I still need to manually enter my password when I use sudo, which obviously an automated process shouldn't have to do.

Although my /etc/ssh/sshd_config has PermitRootLogin yes, I can't seem to be able to login as root, presumably because it's not a "real" account with a separate password.

How do I configure SSH keys, so a process can remotely login as root on Ubuntu?

share|improve this question
If you automate installation from a central machine, you can limit the scope of the key so it will only be accepted from the given host. Simply prefix the line in authorized_keys with from="" ssh-rsa [...] – Egil Mar 23 '12 at 10:03
up vote 29 down vote accepted

EDIT: As alluded to in the comments, although directly answering the question, this answer does leave you open to calculated risk. Ubuntu locks down root access and adds sudo as a way to accomplish admin tasks for a reason.

Answering the Question

So, you want to login AS root via SSH so that you can run an update script.

You need to add your key to the root authorized_keys file on the server.

On the Server

  1. sudo su - root
  2. ssh-keygen (to make sure root has the .ssh directory etc)
  3. Add your public key to .ssh/authorized_keys
  4. Check your sshd_config settings (/etc/ssh/sshd_config) are correct one last time.

    PermitRootLogin without-password  
    RSAAuthentication yes
    PubkeyAuthentication yes
  5. Ensure those settings take effect by restarting ssh: service ssh restart

On the Client

  1. Login to the server as root using: ssh root@yourserveraddress

Note: If this doesn't work you'll need to do some further investigations.. Try posting the results of an ssh -v root@yourserveraddress.

Recommended alternative approach

For security reasons the above approach, although answering the question, should not really be used as it opens up the root account to login. Although key based authentication is vastly more secure than passwords, it's still better practice to disallow any form of root login through SSH.

A better approach is to create a user with limited scope password-less sudo commands and add key based SSH access to that user, as alluded to in other peoples answers.

share|improve this answer
As a note though.... please disable PasswordAuthentication in sshd at the very least to lock things down a bit. Otherwise your root account is still vulnerable to password attempts... not good – Ashimema Mar 23 '12 at 9:21
-1 Every time you give instructions on how to do something dangerous, you must give warning as to why it is dangerous, and when possible show a better way. See discussion on – David Oneill Mar 23 '12 at 17:08
@DavidOneill: that is true, but I think the answer is still a good one. Does it really deserve to be downvoted? – Jo-Erlend Schinstad Mar 23 '12 at 21:17
I removed my -1 now that there is a warning. Thanks for adding that! :) – David Oneill Mar 25 '12 at 14:09
Be careful when changing to: PermitRootLogin without-password because if key login isn't set up correctly, then you won't be able to log back in with a password – timhc22 Apr 2 '15 at 15:26

You are confusing two different things:

passwordless log is used to make sure that people can't log into your system remotely by guessing your password. If you can ssh username@machine and connect without a password, this is set up correctly, and has nothing else to do with this.

sudo is used to permit a normal user account to do something with super user permissions. This does require the user to type their password. This happens whether you are connected remotely (via passwordless or password-protected SSH) or are local on the machine. You are trying to set sudo to not ask for your password, which is not recommended, but you can learn how to do that via an answer like

Note to future readers of this answer:

My above answer does not answer the original poster's actual question, it describes what you should do instead. If you really want to allow remote connections directly to the root account, you need to enable the root account (see my comment below). Again, let me say DO NOT allow remote remote log-ins to your root account.

share|improve this answer
You're misunderstanding me. I know the difference between SSH and sudo. The problem is that I'm unable to ssh using root@machine. Using my "normal" account and adding it to my sudoers file would accomplish the same thing, but I was trying to do it solely through SSH. This is possible in Redhat based distros. I take your answer to mean this is not possible in Debian based distros. – Cerin Mar 22 '12 at 19:58
@Cerin Ah - you want to enable root log-in Again, this is almost always a bad idea, especially when you're allowing external connections. But, the link in the comment describes how to do it. – David Oneill Mar 22 '12 at 20:40
Thanks. Since my goal is automated software installation, does it matter whether I add a non-root user to sudoers, or allow root log-in? There both potential security concerns, but one of them is necessary. – Cerin Mar 23 '12 at 0:22
sudo provides more fine-grained control. For instance, you could allow the non-root user to run apt as root without giving a password, but not arbitrary commands. Since your goal is automated software installation, you should use the least privileged solution to your goal. – Egil Mar 23 '12 at 9:54
@Cerin Yes, it does matter. Beyond what Egil pointed out, is a whole discussion of why logging in a root is a bad idea. – David Oneill Mar 23 '12 at 17:04

PermitRootLogin controls whether the user named "root" (to be precise: any user with UID 0) is allowed to login. If you're logging as root, you do not need sudo to perform privileged tasks.

On the other hand, if you to login on a user account and use sudo without a password, you must configure the sudoers file without having to fiddle with /etc/ssh/sshd_config. See How to make Ubuntu remember forever the password after the first time

share|improve this answer

Q. Login to remote host as root user using passwordless SSH (for example ssh root@remotehost_ip)

A. In order to login to remote host as root user using passwordless SSH follow below steps.

1st Step:
First you have to share local user's public key with remote host root user's authorized_keys file. There are many ways to do so, here is one example.

Or you can simply copy paste your public key content to remote host root user's authorized_keys file.

2nd step:
Configure ssh to permit passwordless login in remote host. Login to remote host and edit /etc/ssh/sshd_config file then restart ssh service. Do not forget to comment out "PermitRootLogin yes".

#vim /etc/ssh/sshd_config
PermitRootLogin without-password
StrictModes no

#service ssh restart

Comment out #PermitRootLogin yes

3rd step:
Test you connection from your local machine using user whose public key is shared earlier.

$ssh root@remotehost_ip
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.