EL 9: Root password login off by default

EL 9 tightens sshd’s default from “root password logins allowed” to PermitRootLogin prohibit-password: the root account can still use SSH, but public-key authentication only — password authentication is refused by default. This is one of the EL 9 changes people most often trip over on upgrade day.

What changed

sshd’s PermitRootLogin controls how root may log in remotely:

• yes: passwords and keys both allowed (the effective default on EL 8 and earlier);
• prohibit-password: only passwordless authentication such as public keys (the default since EL 9);
• no: no direct root login at all.

EL 9’s distribution configuration sets the value to prohibit-password. The effect: an SSH login attempt with the root password is rejected with Permission denied (publickey,gssapi-keyex,gssapi-with-mic), while root logins with a configured key are unaffected.

Note

When the EL 9 installer (Anaconda) is given a root password but no SSH key, it preserves the old behavior (writing back PermitRootLogin yes) so that “install, then log in with the password” still works. Different machines on the same release can therefore have different defaults — always check the effective value with sshd -T.

EL 8 vs EL 9

Item	EL 8	EL 9
Distribution default for PermitRootLogin	yes (password allowed)	prohibit-password (keys only)
Root SSH login with password	allowed	refused by default
Root SSH login with key	allowed	allowed

What it means for you

• Automation that relies on the root password: first-boot scripts, out-of-band management, and legacy provisioning flows that SSH in as root with a password will fail after an upgrade or reinstall.
• Shared-password operations: teams sharing one root password are pushed toward personal keys plus sudo — which is the safer practice anyway.
• Unaffected: the flow of logging in as a regular user with a password and elevating via su / sudo; root key-based logins.

Checking and adjusting

Show the effective sshd value

sudo sshd -T | grep -i permitrootlogin

(Not recommended) Re-enable root password login

# In a drop-in under /etc/ssh/sshd_config.d/ or in sshd_config:
#   PermitRootLogin yes
sudo systemctl reload sshd

The better direction is to lean into the hardening: distribute personal keys, disable direct root login (PermitRootLogin no), and audit elevation through sudo. See SSH hardening for the full recipe.

Further reading

• SSH hardening — key distribution, algorithm policies, hardening checklist
• Upgrading EL 8 → EL 9 — the EL 8 → EL 9 upgrade path
• EL 10: Post-quantum cryptography — what the next generation of SSH enables by default