50

I'm using the default installation of openssh-server for my Ubuntu 14.04 server. I can connect through the console as root like normal, with my username and password. When I try to SSH with the same username/password, however, I repeatedly get Access Denied errors. /var/log/auth.log reports Failed password for root from <ip address> port <port> ssh2, but I'm entering the correct password.

Why can't I connect to the server via SSH, even though the username and password ARE correct?

6

3 Answers 3

104

The default setting in Debian (and hence Ubuntu) for OpenSSH Server is to deny password-based login for root and allow only key-based login. Change this line in /etc/ssh/sshd_config:

PermitRootLogin without-password

to

PermitRootLogin yes

And restart the SSH server:

sudo service ssh restart
9
  • Aha, that did it! Thank you, I greatly appreciate it!
    – vaindil
    Aug 15, 2014 at 16:35
  • 2
    @Vaindil But really, as gregory.0xf0 says, if you must log in remotely as root, it's much better to use key-based instead of password-based authentication. Aug 16, 2014 at 2:16
  • @Vaindil I second EliahKagan and gregory.0xf0 that key-based authentication is superior to password based. Switch to it if you can.
    – muru
    Aug 16, 2014 at 3:39
  • It is, by the way, bad practice to allow root login anyways via SSH or via the GUI, you should only ever need root login in cases where sudo is disabled.
    – Thomas Ward
    Aug 16, 2014 at 21:27
  • 1
    If it still not working, please try setting password for the root. For me that helps: sudo passwd root
    – kkochanski
    Jul 1, 2017 at 20:37
7

To me, works changing (Ubuntu 18.04):

  • sudo nano /etc/ssh/sshd_config

  • PermitRootLogin prohibit-password to PermitRootLogin yes
  • PasswordAuthentication no to PasswordAuthentication yes

then, restart ssh service:

  • sudo service ssh restart

Thanks!

1
  • you can add to your answer: some default installations require changing root password for ssh as root directly, as is the case of Kali Rpi.
    – charles
    Jul 30, 2020 at 22:18
2

Hackers will bang away with root user trying to brute force their way in. If you are going to allow root logins, you should definitely install Fail2Ban, or something similar to protect against brute force attacks. Also use a very hard to guess password without the use of common words.

And, as Vaindil pointed out, a key based login would be far superior. They are not very hard to setup. Here's a link to setup key-based login using PuTTY on windows: https://devops.profitbricks.com/tutorials/use-ssh-keys-with-putty-on-windows/ . But there are lots of others if you are using a different environment to login from.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .