I have set my live IP in /etc/hosts.allow, and deny all other hosts. I have also set PermitRootLogin without-password in /etc/ssh/sshd_config.

Is that a secure method? Can an attacker crack my key and login to my server? If yes then please explain how it is possible.

  • 2
    One of the reasons why someone might downvote is because of "lack of research effort". Reading the documentation for PermitRootLogin will answer half of your question. The other half "Can attacker crack key and login my server?" is a completely different question.
    – schroeder
    Nov 29, 2017 at 8:27

3 Answers 3


This is a common misunderstanding for the PermitRootLogin feature. The without-password option does not mean there is no authentication and anyone can get in without a password. All this option means is that logging in is only possible using a fallback method, such as public key authentication. Even if an attacker knows your root password, they will not be able to log in unless they have your private key.

It is actually better to use without-password if you need to log in as root, since it ensures that the root account cannot be brute forced. If you were to log in as root with a password, it could be subject to being remotely attacked, whereas public key authentication ensures you can only log in with the proper credential files. This is better than logging in as a different user and using su to elevate to root, as a compromise of that other user would result in a compromised root, since the user can monitor any keystrokes entered into its shell. This is explained in detail in the answer to Which is the safest way to get root privileges: sudo, su or login?.

If you do not need to have root, then using another, dedicated user would be fine. In this case, setting PermitRootLogin no would be beneficial, as there is no reason to have root access if not required.

  • In my config I see #PermitRootLogin prohibit-password -- is this equivalent to PermitRootLogin no since it's commented out?
    – thdoan
    Aug 27, 2023 at 5:18
  • 1
    @thdoan No. Having prohibit-password still allows logging in as root using public key authentication. If it's set to no then even public key authentication cannot be used for root.
    – forest
    Aug 27, 2023 at 10:48
  • Thanks, I've set it to no.
    – thdoan
    Aug 27, 2023 at 11:01

First let's see what does it mean:


Specifies whether root can log in using ssh(1). The argument must be yes, prohibit-password, forced-commands-only, or no. The default is prohibit-password.

If this option is set to prohibit-password (or its deprecated alias, without-password), password and keyboard-interactive authentication are disabled for root.

If this option is set to forced-commands-only, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for taking remote backups even if root login is normally not allowed). All other authentication methods are disabled for root.

If this option is set to no, root is not allowed to log in.

Better practice is to use PermitRootLogin no, because you don't want to allow root to directly authenticate into the system.

Edit 19.1.2022:

5.3.10 Ensure SSH root login is disabled (Automated)

Disallowing root logins over SSH requires system admins to authenticate using their own individual account, then escalating to root via sudo . This in turn limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident

Source: CIS for Ubuntu Linux

  • 2
    That is a dangerous practice to promote, considering logging in as another user and elevating yourself to root from it gives that user way too much power.
    – forest
    Nov 29, 2017 at 6:07
  • If I use my live ip in /etc/hosts.allow then how attack can be done?
    – LOKESH
    Nov 29, 2017 at 6:46
  • 1
    The /etc/hosts.allow is useful for an additional layer of protection, but it must not be relied on for authentication. You do not want someone who is able to pivot through your computer or your ISP, or even just get your old IP when it switches (e.g. with dynamic IPs) to be able to access your server.
    – forest
    Nov 29, 2017 at 6:50
  • 1
    Logging in as root using a private key will still perfectly satisfy audit requirements because the user's individual key fingerprint will be in the logs. Nov 30, 2022 at 9:26

Yes it's a secure method because you can't brute force cryptographic key.

For example if you use a RSA key (ssh-keygen -t rsa) https://crypto.stackexchange.com/questions/3043/how-much-computing-resource-is-required-to-brute-force-rsa

The only solution for the hacker is to steal your private/public keys.

  • 1
    That's not a good reference for saying RSA is secure. It talks about a very specific way of trying to break RSA (enumerating all primes of a certain size), but there are much much better ways to attack RSA (ie factoring). The answer is also talking about 1024 bit keys, which NIST recommended deprecating by 2013. While no 1024 bit keys have been (publicly) broken yet, using one at this point is very questionable. Mar 29, 2019 at 17:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .