Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

As Ubuntu has no real root account, why is /etc/ssh/sshd_config allowing remote root login anyway? Isn't that inconsistent?

share|improve this question
That option is not irrelevant, because you can sudo ssh root@host with a ssh key. Ubuntu has a real root account, only its password is locked, see Is there a root password on OS X and Ubuntu?. – enzotib Jan 24 '12 at 9:24
Oh I didn't know that, so far I always logged in as a user and then sudo -i. Thanks for clarification. – math Jan 24 '12 at 9:27
up vote 3 down vote accepted

I'm not a member of the Ubuntu Openssh team, so I don't know the real reason, all of this is mere speculation, but...

It is consistent with the policy of making only necessary changes from Debian. It means, if root login is disabled in Ubuntu, you don't gain anything from adding a new difference from upstream, a difference that you will have to manage in every release and update.

share|improve this answer
Exactly. Root doesn't have a password nor a pub key. (Empty passwords are not permitted by default.) Thus, no authentication method will succeed for root and root login is effectively disabled. – Jan Jan 24 '12 at 9:16

But while root login IS effectively disabled, having "PermitRootLogon yes" prevents fail2ban from being able to impose an IP ban on the offending address, because the expected error message is not logged in auth.log. For that reason, I have changed PermitRootLogon to "no".

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.