0

I don't understand why I get no access for root on my Raspberry Pi 4 while trying to use key-based authentification via ssh.

So far I generated a public/private rsa keypair using PuTTYgen:

PuTTYgen key generation

I saved both of them of course:

Key files

Then I looked into this config: sudo nano /etc/ssh/sshd_config

And confirmed that it had the following settings set:

PermitRootLogin yes

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

Lastly I added the public key to the .ssh/authorized_keys file with the following format: ssh-rsa <KEY> root@RPI4

The result for this is that I can't login with root. But what left me clueless was being able to login as pi:

Fail Success

How to make this work as root?

2
  • Is ~root/.ssh owned by root and drwx --- --- (700)? Is authorized_keys owned by root and -rw- --- --- (600)? Feb 26 at 21:28
  • @LjmDullaart Yes, I forgot to include that. I set those permissions. Even tho the files are located in /home/pi/ and not /root/. As far as I remember I got an error otherwise and could not proceed any further
    – Mister X
    Feb 26 at 22:41
1

Your remark

@LjmDullaart Yes, I forgot to include that. I set those permissions. Even tho the files are located in /home/pi/ and not /root/. As far as I remember I got an error otherwise and could not proceed any further

reveals what is wrong. To access the Pi as root, the authorized_keys must be under /root/.ssh, with the permissions 700 for .ssh and 600 and owned by root.

The .ssh and .ssh/authorized_keys under /home/pi are for the user pi and not for root. They should be owned by root.

Make sure that in /etc/ssh/sshd_config there is a line PermitRootLogin yes.

1
  • You resolved my problem. Thank you very much. If I place the public key in /root/.ssh/authorized_keys I can login as root. I was so close yesterday tho...
    – Mister X
    Feb 27 at 15:42
0

You make it work as root by leaving the configuration alone.

MacUser2525:~$ cat .ssh/id_rsa.pub 
ssh-rsa AAAAB3N
MacUser2525:~$ ssh root@192.168.0.116
Linux buster-raspi 5.9.0-0.bpo.5-arm64 #1 SMP Debian 5.9.15-1~bpo10+1 (2020-12-31) aarch64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Feb 23 22:22:43 2021 from fe80::1003:5492:80fa:2bc5%eth0
root@buster-raspi:~# cat  .ssh/authorized_keys 
ssh-rsa AAAAB3NzaC1

With this setting you enabled you have allowed root to login with a password.

root@buster-raspi:~# cat /etc/ssh/sshd_config | grep Root
#PermitRootLogin prohibit-password
# the setting of "PermitRootLogin without-password".

These are not needed to be changed as well.

root@buster-raspi:~# cat /etc/ssh/sshd_config | grep Pubkey
#PubkeyAuthentication yes
root@buster-raspi:~# cat /etc/ssh/sshd_config | grep Authorized
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

In short I have nothing set that you do only the defaults that load, the contents of my id_rsa.pub in the /root/.ssh/authorized_keys file allows me to login as root. At least the guide you follow has not told you to change the port. This will only work if the root user is enabled on your Pi I see nothing saying you did this.

sudo passwd root

That sets your root password and enables the root user.

I would add this is only used by me for one purpose. Backing up the Pi to my backup drive over the network it needs root access for those files owned by it, as the Pi USB implementation is so poor, it is faster to do it that way. All you save by not doing it the correct more secure way of logging in as normal user then going to root with su is one step.

2
  • I am corious how you could set this up to work. The option AuthorizedKeysFile points to .ssh/authorized_keys. If I remove it - it works for me too. So I assume the default values are used, if not changed in the config. But if I change the option PubkeyAuthentication yes to #PubkeyAuthentication yes, it still works. So actually only PermitRootLogin yes needs to be changed I assume. I appreciate you pointing that out. So you could actually boil down the steps to only enable PermitRootLogin yes, generate a keypair & place the public key in authorized_keys of the user directory.
    – Mister X
    Feb 27 at 15:51
  • Disable the root login that is for a password login, it is what we want to avoid with the keys method. Nothing needs to be changed in the default file for it to work with a key in the `/root/.ssh/authorized_keys file.
    – user130167
    Feb 27 at 16:21
0

You normally can't login as root as this is a security risk.

Indeed Debian doesn't even have a root login because there is no need - use sudo instead.

Normally you use sudo su to become root, but there are few circumstances that require this.

If you really want to do this you will have to create a root login and configure the keys for the root user.

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .