How to get access via ssh as root - with public/private key

Question

I don't understand why I get no access for root on my Raspberry Pi 4 while trying to use key-based authentification via ssh.

So far I generated a public/private rsa keypair using PuTTYgen:

I saved both of them of course:

Then I looked into this config: sudo nano /etc/ssh/sshd_config

And confirmed that it had the following settings set:

PermitRootLogin yes

PubkeyAuthentication yes

AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2

Lastly I added the public key to the .ssh/authorized_keys file with the following format: ssh-rsa <KEY> root@RPI4

The result for this is that I can't login with root. But what left me clueless was being able to login as pi:

How to make this work as root?

Answer 1

Your remark

@LjmDullaart Yes, I forgot to include that. I set those permissions. Even tho the files are located in /home/pi/ and not /root/. As far as I remember I got an error otherwise and could not proceed any further

reveals what is wrong. To access the Pi as root, the authorized_keys must be under /root/.ssh, with the permissions 700 for .ssh and 600 and owned by root.

The .ssh and .ssh/authorized_keys under /home/pi are for the user pi and not for root. They should be owned by root.

Make sure that in /etc/ssh/sshd_config there is a line PermitRootLogin yes.

Answer 2

You make it work as root by leaving the configuration alone.

MacUser2525:~$ cat .ssh/id_rsa.pub 
ssh-rsa AAAAB3N
MacUser2525:~$ ssh [email protected]
Linux buster-raspi 5.9.0-0.bpo.5-arm64 #1 SMP Debian 5.9.15-1~bpo10+1 (2020-12-31) aarch64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Tue Feb 23 22:22:43 2021 from fe80::1003:5492:80fa:2bc5%eth0
root@buster-raspi:~# cat  .ssh/authorized_keys 
ssh-rsa AAAAB3NzaC1

With this setting you enabled you have allowed root to login with a password.

root@buster-raspi:~# cat /etc/ssh/sshd_config | grep Root
#PermitRootLogin prohibit-password
# the setting of "PermitRootLogin without-password".

These are not needed to be changed as well.

root@buster-raspi:~# cat /etc/ssh/sshd_config | grep Pubkey
#PubkeyAuthentication yes
root@buster-raspi:~# cat /etc/ssh/sshd_config | grep Authorized
#AuthorizedKeysFile .ssh/authorized_keys .ssh/authorized_keys2
#AuthorizedPrincipalsFile none
#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

In short I have nothing set that you do only the defaults that load, the contents of my id_rsa.pub in the /root/.ssh/authorized_keys file allows me to login as root. At least the guide you follow has not told you to change the port. This will only work if the root user is enabled on your Pi I see nothing saying you did this.

sudo passwd root

That sets your root password and enables the root user.

I would add this is only used by me for one purpose. Backing up the Pi to my backup drive over the network it needs root access for those files owned by it, as the Pi USB implementation is so poor, it is faster to do it that way. All you save by not doing it the correct more secure way of logging in as normal user then going to root with su is one step.

Answer 3

You normally can't login as root as this is a security risk.

Indeed Debian doesn't even have a root login because there is no need - use sudo instead.

Normally you use sudo su to become root, but there are few circumstances that require this.

If you really want to do this you will have to create a root login and configure the keys for the root user.