Openssh 7 breaks root login by password

[PiCloud01]

Did a new clean new archARM build this afternoon, pushed through a pacman -Syu system update while still using the default alarmpi root account, and then found I could no longer log in to my new system over ssh with the default root account and password.

OpenSSH 7 turned out to be the culprit ( openssh-7.0p1 deprecates ssh-dss keys / https://www.archlinux.org/news/openssh- ... -dss-keys/ ), with one of its "Potentially-incompatible Changes" being

* The default for the sshd_config(5) PermitRootLogin option has
changed from "yes" to "prohibit-password".

(http://lists.mindrot.org/pipermail/open ... 00122.html)

A quick edit of /etc/ssh/sshd_config puts things back as they were.

I know permitting root login (with password) over SSH is ill-advised on security groups, but given its the default account on a new arch ARM system, I bet there's a lot of people still doing it. Hope this post saves someone some time...

/ CB

[WarheadsSE]

We will be addressing this in new filesystems soon.

(Also, it is not archARM. We've got a full, legal department approved name, an acronym: ALARM)

[Espionage724]

$this->bbcode_second_pass_quote('', 'A') quick edit of /etc/ssh/sshd_config puts things back as they were.

[PiCloud01]

There are plenty of potentially incompatible changes in the new openssh.
In my case I could make an SSH connection to the updated system using the root account, and get as far as the password prompt, but the system was rejecting the password. So my basic SSH access to the updated system was fine, it was just a matter of working out what had happened to the root account. PermitRootLogin was the only change I made to the new sshd_config to fix it ...

$this->bbcode_second_pass_code('', '# Authentication:
#LoginGraceTime 2m
#PermitRootLogin prohibit-password
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10')

As WarheadsSE notes something like this will have to be done in the ALARM tarballs next time they get regenerated.


/ CB

[WarheadsSE]

They have now been regenerated, and the installation instructions updated.