iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
If SSH rejects a root login, changing PermitRootLogin alone may not fix it. The effective setting can come from an included configuration snippet or a conditional Match block, while PasswordAuthentication, keyboard-interactive authentication, public-key settings, AuthenticationMethods, account policy, or PAM can independently deny access. Keep your current session open, test the effective configuration, and use a second terminal or provider console before reloading SSH.
What PermitRootLogin actually controls
PermitRootLogin controls whether the root account may authenticate through SSH and which authentication methods are acceptable for it. It does not turn every other SSH authentication control on. Ubuntu and Debian OpenSSH manuals define four important values:
| Value | Root-login behavior | Typical use |
|---|---|---|
no |
Root SSH login is refused. | Preferred baseline; use a named account with sudo. |
prohibit-password |
Password and keyboard-interactive authentication are disabled for root, while other methods such as public keys remain possible. | Direct root access only when an operational requirement exists, using keys. |
without-password |
Deprecated alias for prohibit-password. |
Replace it with prohibit-password in new configuration. |
forced-commands-only |
Root keys are accepted only when the key has a forced command attached; other root authentication is denied. | Narrow automation such as a tightly constrained backup or deployment action. |
yes |
Root login is allowed, subject to all other SSH, account, and PAM checks. | Temporary or exceptional use; generally a poor Internet-facing baseline. |
Therefore, a root password can still fail when PermitRootLogin yes is present if PasswordAuthentication no, keyboard-interactive authentication is disabled, a later policy requires another method, or the root account itself is locked or restricted.
Protect yourself before changing SSH
- Leave the working SSH session connected. Do not close it until a new login has succeeded.
- Open a second administrative path. Use an existing non-root account with
sudo, a VPS provider’s serial/web console, or another out-of-band administrator. If the reload breaks SSH, this path is how you recover. - Record the current state. Save the relevant files and note the service name used by the distribution. Ubuntu and Debian commonly use
ssh; some distributions expose ansshdservice name. - Know the client address for conditional rules. You will need the public source address of the computer making the test connection when evaluating
Matchconditions.
Use a reload rather than a stop/start operation after validation. A reload lets the daemon read the new configuration while existing sessions normally remain alive, but it does not remove the need for a second test session.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application:Upgraded attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Warranty & Support: Our Electric air duster comes with 5 years warranty and 24/7 customer service. During this period, if you have any questions,pls kindly feel free to contact us.
Find the configuration that is really active
Inspect the main file and included snippets
Ubuntu’s default /etc/ssh/sshd_config includes /etc/ssh/sshd_config.d/*.conf. Cloud images and VPS providers may place hardening or cloud-init settings in those snippets. Inspect both the main file and every matching snippet:
sudo grep -RniE '^[[:space:]]*(Include|Match|PermitRootLogin|PasswordAuthentication|KbdInteractiveAuthentication|ChallengeResponseAuthentication|PubkeyAuthentication|AuthenticationMethods|AllowUsers|DenyUsers)' /etc/ssh/sshd_config /etc/ssh/sshd_config.d 2>/dev/nullAlso open the files rather than relying only on a grep result. A directive inside a Match block applies only when its conditions match. A line that looks correct in the global section may not govern your connection. OpenSSH processes included files in the order they are encountered, and for most single-value directives the first obtained value is the one used. A seemingly later edit therefore may not override an earlier snippet. The daemon’s effective output, not the location of the line you edited, is the authority.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsSearch every control that can reject root
PermitRootLogin: whether root may authenticate and which root methods are allowed.PasswordAuthentication: whether password authentication is offered at all.KbdInteractiveAuthenticationand the olderChallengeResponseAuthenticationname: whether keyboard-interactive or challenge-response authentication is available.PubkeyAuthentication: whether public-key authentication is enabled.AuthenticationMethods: whether one method is sufficient or a sequence of methods is required.AllowUsers,DenyUsers, and related allow/deny rules: whether the account is admitted by policy.- Account state and PAM restrictions: whether the root account is locked, expired, denied by an access rule, or subject to a login restriction outside
sshd_config.
AuthenticationMethods is a frequent source of confusion. If it requires multiple methods in sequence, a password can be rejected even when password authentication and root login are both enabled, because the client has not completed the required additional method.
Validate syntax and display the effective values
Run a syntax check before reloading
For the normal configuration path, run:
sudo sshd -tNo output means the syntax check passed. A parser error identifies a line that must be corrected before any reload. If the daemon uses a non-default file, test that exact file:
sudo sshd -t -f /path/to/sshd_configDo not treat a successful editor save as validation. A typo in a keyword, an invalid value, a missing include, or an unintended conditional block can prevent a reload or produce a policy different from the one you intended.
Ask sshd what it will use
Inspect the daemon’s effective global values:
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|authenticationmethods'This output shows the values after defaults and included files have been processed. It is more reliable than reading a commented example or assuming the last visible line wins.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Evaluate a conditional rule for the actual connection
To account for Match rules, supply the connection context. Replace CLIENT_IP with the address of the computer from which you will connect:
sudo sshd -T -C user=root,host=$(hostname),addr=CLIENT_IP | grep -E 'permitrootlogin|passwordauthentication|kbdinteractiveauthentication|pubkeyauthentication|authenticationmethods'The CIS hardening guidance demonstrates this sshd -T -C ... pattern for checking PermitRootLogin. If the conditional output differs from the global output, the conditional result governs that test connection.
Choose the least-permissive working fix
Preferred administration: disable direct root SSH
For routine administration, set:
PermitRootLogin noCreate or use a named administrator, grant only the required sudo privileges, and connect as that account. This creates an identifiable login trail and limits the consequences of exposing a root credential. Red Hat’s RHEL 9 network-security hardening guidance also lists PermitRootLogin: no as its hardening control.
Direct root access with keys only
If a documented operational requirement makes direct root access unavoidable, use:
PermitRootLogin prohibit-passwordThis is not a password-login fix. It intentionally rejects root passwords and keyboard-interactive authentication; it permits other methods, normally a public key. The key must be installed and accepted by the rest of the SSH policy.
Forced-command root keys
Use forced-commands-only only when the root key is intended to run a fixed command. The authorized_keys entry must carry a forced command, and ordinary interactive root shells will not work. This mode is unsuitable if you expect to log in and obtain a normal root prompt.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Allow root passwords only as an exception
PermitRootLogin yes permits root password authentication only if password authentication is enabled and no other policy blocks it. Exposing a root password to Internet SSH increases the impact of password guessing, credential reuse, and a leaked password. If it is temporarily required, define an expiration or rollback plan, restrict source addresses where practical, and return to a key-only or disabled-root policy immediately afterward.
Fix a key-only root login that still fails
Install the public key for the root account
For a key-only policy, the public key belongs in root’s authorized-keys file:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutesudo install -d -m 700 -o root -g root /root/.ssh
sudo install -m 600 -o root -g root /path/to/root-public-key /root/.ssh/authorized_keysIf you are adding a line manually, append the complete single-line public key, including its key type and comment. Verify that the file is owned by root and is not writable by untrusted users. Check that PubkeyAuthentication yes is effective. On the client, specify the matching private key explicitly when more than one key is loaded:
ssh -i /path/to/private_key root@SERVER_IPNever copy a private key to the VPS. The server needs only the public half; keep the private key protected on the client.
Separate key failure from policy failure
Run a verbose client connection:
ssh -vvv -i /path/to/private_key root@SERVER_IPIn the output, confirm that the client offers the intended key and that the server advertises public-key authentication. If the key is offered and rejected, inspect the authorized-keys path, ownership, permissions, account restrictions, and server logs. If public-key authentication is not advertised, inspect the effective PubkeyAuthentication, AuthenticationMethods, Match, and allow/deny settings instead of repeatedly replacing the key.
Why a root password is rejected
prohibit-password is working as designed
With PermitRootLogin prohibit-password, a correct root password is still refused. Switch to the installed public key or change to a safer named-user workflow; do not keep trying the password.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Password authentication is globally disabled
When the effective value is:
PasswordAuthentication noSSH will not accept passwords for root or other users through that method. A root-login setting cannot override this independent control.
Keyboard-interactive authentication is disabled
Some clients label a password prompt as keyboard-interactive. Check both:
KbdInteractiveAuthentication
ChallengeResponseAuthenticationDistribution and OpenSSH versions may expose one name, the other, or both. Inspect sshd -T rather than assuming the label shown by the client identifies the server-side method.
Free tools Windows power users keep installed
One-click scans. No signup required.
A method sequence is required
If AuthenticationMethods contains a sequence, complete every method in the order advertised. For example, a policy that requires a public key followed by another factor will not accept a password as a substitute for the key.
The account or access policy blocks root
Check AllowUsers and DenyUsers, root’s account state, PAM access rules, expiration, and any provider image hardening. A valid password does not bypass an account-level denial.
Reload safely and verify from a new connection
- Edit the intended file, preserving a backup of the previous version.
- Run
sudo sshd -t, or include-ffor a custom file. - Inspect global values with
sudo sshd -Tand conditional values withsudo sshd -T -C ...when aMatchrule is relevant. - Reload the service:
sudo systemctl reload ssh, or use the service name supplied by your distribution. - From a second terminal, test the exact intended method and account. For a key-only root policy, test the root key; for the safer baseline, test the named sudo account.
- Only after the new connection succeeds should you close the original administrative session.
A reload does not prove that your intended policy is reachable from your network. The new connection test is the practical verification that the daemon, account, network path, and authentication method work together.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Read the logs when the second test fails
Server-side logs
On systemd-based systems, inspect the SSH service journal. The unit may be named ssh or sshd:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo journalctl -u ssh
sudo journalctl -u sshdUse the unit that exists on the VPS. Look at entries generated at the time of the failed attempt. They can distinguish an invalid user, a denied root policy, a missing key, a permissions problem, a PAM refusal, or a method that the client did not complete.
Client-side logs
Keep ssh -vvv output from the same attempt. Compare the methods the client offers with those the server accepts. A client that never offers the method required by AuthenticationMethods cannot complete the login, even when the server configuration is syntactically valid.
Common configuration mistakes and recovery paths
You edited a file that is not in use
Check for a custom daemon invocation or alternate configuration path and validate it with sshd -t -f and sshd -T -f. If the effective output does not change after an edit, locate the active file, an earlier included value, or a provider-managed snippet.
An included snippet wins over your edit
Search every file under /etc/ssh/sshd_config.d. Move the policy to the appropriate file or remove the conflicting directive according to the image’s management model, then rerun the effective-value check. Do not create several contradictory lines and rely on visual order.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →A Match block changes only some connections
Use sshd -T -C with the real user, host, and client address. Test from the same source address that the rule targets. A successful check as one user or address does not prove that root from another address will be accepted.
A reload fails or the new session is refused
Keep the original session open, read the syntax error or journal entry, restore the last known-good configuration, rerun sshd -t, and reload again. If no SSH session can be established, use the VPS provider console or another out-of-band path to repair the file. This is why closing the first session immediately after a reload is unsafe.
A practical decision table
| Situation | Authentication method | Configuration approach | Blast radius | Recovery requirement |
|---|---|---|---|---|
| Normal server administration | Named user plus SSH key and sudo |
PermitRootLogin no |
Named identity rather than direct root | Keep a second sudo or console path during changes |
| Exceptional direct root administration | SSH public key; no root password | PermitRootLogin prohibit-password, with effective public-key authentication |
Direct root shell if the key is compromised | Verify the key in a second terminal before closing the old session |
| Automation requiring one root action | Public key with a forced command | PermitRootLogin forced-commands-only and a constrained authorized_keys entry |
Limited by the forced command, but still root-owned automation | Console or sudo path for correcting the key or command |
| Temporary password-based exception | Root password | PermitRootLogin yes plus effective password and PAM policy |
Largest direct-root exposure | Preplanned rollback and a second administrative path |
Compare any proposed fix on five axes: the authentication method it enables, the blast radius of a compromised credential, the configuration scope that controls it, the availability of a recovery path, and whether syntax plus effective-value checks were performed.
Quick Recap
Final checklist
- Current SSH session remains open.
- A second sudo account or provider console is available.
- All main and included configuration files have been searched.
Matchblocks and client address conditions have been evaluated.PermitRootLogin, password, keyboard-interactive, public-key, and method-sequence settings have been checked together.- Account, PAM, allow/deny, expiration, and lock status have been considered.
sudo sshd -tpasses.sudo sshd -T, andsshd -T -Cwhen needed, show the intended values.- The service is reloaded only after validation.
- A new connection using the exact intended account and method succeeds before the old session is closed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
