With "PermitRootLogin forced-commands-only" in /etc/ssh/sshd_config,
access is not allowed.  Instead, I get:

dilinger@wax:~$ ssh root@localhost id
socket: Address family not supported by protocol
root@localhost's password:

In /var/log/auth.log, I get:

Jan 12 13:09:34 wax sshd[31981]: ROOT LOGIN REFUSED FROM 127.0.0.1

If I change sshd_config to use "PermitRootLogin without-password", it
works fine:

dilinger@wax:~$ ssh root@localhost id
socket: Address family not supported by protocol
uid=0(root) gid=0(root) groups=0(root)


 From the sshd_config manpage:
      If this option is set to ``forced-commands-only'' root login with
      public key authentication will be allowed, but only if the
      command option has been specified (which may be useful for taking
      remote backups even if root login is normally not allowed). All
      other authentication methods are disabled for root.


My sshd_config is below:

# Package generated configuration file
# See the sshd(8) manpage for defails

# What ports, IPs and protocols we listen for
Port 22
# Uncomment the next entry to accept IPv6 traffic.
#ListenAddress ::
#ListenAddress 0.0.0.0
Protocol 2
# HostKeys for protocol version 2
HostKey /etc/ssh/ssh_host_rsa_key
HostKey /etc/ssh/ssh_host_dsa_key
# Lifetime and size of ephemeral version 1 server key
KeyRegenerationInterval 3600
ServerKeyBits 768

# Logging
SyslogFacility AUTH
LogLevel INFO

# Authentication:
LoginGraceTime 600
PermitRootLogin forced-commands-only
StrictModes yes

RSAAuthentication yes
PubkeyAuthentication yes
#AuthorizedKeysFile	%h/.ssh/authorized_keys

# rhosts authentication should not be used
RhostsAuthentication no
# Don't read the user's ~/.rhosts and ~/.shosts files
IgnoreRhosts yes
# For this to work you will also need host keys in /etc/ssh_known_hosts
RhostsRSAAuthentication no
# similar for protocol version 2
HostbasedAuthentication no
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
#IgnoreUserKnownHosts yes

# To enable empty passwords, change to yes (NOT RECOMMENDED)
PermitEmptyPasswords no

# Uncomment to disable s/key passwords
#ChallengeResponseAuthentication no

# To disable tunneled clear text passwords, change to no here!
PasswordAuthentication yes

# Use PAM authentication via keyboard-interactive so PAM modules can
# properly interface with the user
#PAMAuthenticationViaKbdInt yes

# To change Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#AFSTokenPassing no
#KerberosTicketCleanup no

# Kerberos TGT Passing does only work with the AFS kaserver
#KerberosTgtPassing yes

X11Forwarding yes
X11DisplayOffset 10
PrintMotd no
#PrintLastLog no
KeepAlive yes
#UseLogin no

#MaxStartups 10:30:60
#Banner /etc/issue.net
#ReverseMappingCheck yes

UsePrivilegeSeparation no

Subsystem	sftp	/usr/lib/sftp-server

Colin Watson wrote:
| On Mon, Jan 12, 2004 at 01:14:43PM -0500, Andres Salomon wrote:
|
|>With "PermitRootLogin forced-commands-only" in /etc/ssh/sshd_config,
|>access is not allowed.  Instead, I get:
|>
|>dilinger@wax:~$ ssh root@localhost id
|>socket: Address family not supported by protocol
|>root@localhost's password:
|>
|>In /var/log/auth.log, I get:
|>
|>Jan 12 13:09:34 wax sshd[31981]: ROOT LOGIN REFUSED FROM 127.0.0.1
|>
|>If I change sshd_config to use "PermitRootLogin without-password", it
|>works fine:
|>
|>dilinger@wax:~$ ssh root@localhost id
|>socket: Address family not supported by protocol
|>uid=0(root) gid=0(root) groups=0(root)
|>
|>
|> From the sshd_config manpage:
|>      If this option is set to ``forced-commands-only'' root login with
|>      public key authentication will be allowed, but only if the
|>      command option has been specified (which may be useful for taking
|>      remote backups even if root login is normally not allowed). All
|>      other authentication methods are disabled for root.
|
|
| So do you have a command= option for the relevant key in
| ~root/.authorized_keys? I think not, since your transcript above
| indicates that you're using password authentication, and the man page
| explicitly says "root login with public key authentication will be
| allowed [with the command option, and nothing else]".
|
| The authorized_keys file format is described in sshd(8).
|
| Cheers,
|

Ah, no.  The sshd_config manpage simply says "command option"; I (and
another person who came to the same conclusion as me) thought that just
meant the command arg to ssh.  Please add some mention of
.authorized_keys in the sshd_config manpage, as it's confusing for
someone who has just stumbled upon PermitRootLogin forced-commands-only.
~ I'd recommend something like:

"but only if the command option has been specified in root's
.authorized_keys (which may be useful for taking remote backups even if
root login is normally not allowed)."

So do you have a command= option for the relevant key in
~root/.authorized_keys? I think not, since your transcript above
indicates that you're using password authentication, and the man page
explicitly says "root login with public key authentication will be
allowed [with the command option, and nothing else]".

The authorized_keys file format is described in sshd(8).

Cheers,

 >       If this option is set to ``forced-commands-only'' root login with
 >       public key authentication will be allowed, but only if the
 >       command option has been specified (which may be useful for taking
 >       remote backups even if root login is normally not allowed). All
 >       other authentication methods are disabled for root.


You haven't shown us root's authorized_keys file, but I suspect you
didn't actually specify a command correctly in that file?

Matthew