35

I'm using the default installation of openssh-server for my Ubuntu 14.04 server. I can connect through the console as root like normal, with my username and password. When I try to SSH with the same username/password, however, I repeatedly get Access Denied errors. /var/log/auth.log reports Failed password for root from <ip address> port <port> ssh2, but I'm entering the correct password.

Why can't I connect to the server via SSH, even though the username and password ARE correct?

76

The default setting in Debian (and hence Ubuntu) for OpenSSH Server is to deny password-based login for root and allow only key-based login. Change this line in /etc/ssh/sshd_config:

PermitRootLogin without-password

to

PermitRootLogin yes

And restart the SSH server:

sudo service ssh restart
| improve this answer | |
  • Aha, that did it! Thank you, I greatly appreciate it! – vaindil Aug 15 '14 at 16:35
  • 2
    @Vaindil But really, as gregory.0xf0 says, if you must log in remotely as root, it's much better to use key-based instead of password-based authentication. – Eliah Kagan Aug 16 '14 at 2:16
  • @Vaindil I second EliahKagan and gregory.0xf0 that key-based authentication is superior to password based. Switch to it if you can. – muru Aug 16 '14 at 3:39
  • It is, by the way, bad practice to allow root login anyways via SSH or via the GUI, you should only ever need root login in cases where sudo is disabled. – Thomas Ward Aug 16 '14 at 21:27
  • 1
    If it still not working, please try setting password for the root. For me that helps: sudo passwd root – kkochanski Jul 1 '17 at 20:37
5

To me, works changing (Ubuntu 18.04):

  • sudo nano /etc/ssh/sshd_config

  • PermitRootLogin prohibit-password to PermitRootLogin yes
  • PasswordAuthentication no to PasswordAuthentication yes

then, restart ssh service:

  • sudo service ssh restart

Thanks!

| improve this answer | |
  • you can add to your answer: some default installations require changing root password for ssh as root directly, as is the case of Kali Rpi. – charles Jul 30 at 22:18
1

Hackers will bang away with root user trying to brute force their way in. If you are going to allow root logins, you should definitely install Fail2Ban, or something similar to protect against brute force attacks. Also use a very hard to guess password without the use of common words.

And, as Vaindil pointed out, a key based login would be far superior. They are not very hard to setup. Here's a link to setup key-based login using PuTTY on windows: https://devops.profitbricks.com/tutorials/use-ssh-keys-with-putty-on-windows/ . But there are lots of others if you are using a different environment to login from.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.