If you want to keep SSH secure while ensuring compatibility with the cPFence WebUI, you do not need to enable full root login with a password.
Warning: set up key-based SSH access and verify you can log in with your key before disabling passwords. Otherwise you may lock yourself out.
Recommended SSH Configuration
Use the following settings. Root can use keys, passwords are blocked.
Quick Steps
1) Create a hardening file that loads first
sudo tee /etc/ssh/sshd_config.d/01-cpfence-hardening.conf >/dev/null <<'CONF'
PermitRootLogin prohibit-password
PasswordAuthentication no
PubkeyAuthentication yes
CONF
2) Validate and reload SSH
sudo sshd -t && sudo systemctl reload ssh
3) Quick check
sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication|pubkeyauthentication'
Expected
permitrootlogin without-password
passwordauthentication no
pubkeyauthentication yes
Rollback
sudo rm /etc/ssh/sshd_config.d/01-cpfence-hardening.conf
sudo systemctl reload ssh
Notes
- Ubuntu reads
/etc/ssh/sshd_config.d/*.confat the start, and the first value wins. Using01-...avoids later overrides from other files. - Seeing
without-passwordin the check is normal. It is the canonical alias ofprohibit-password.
Need help
Visit our Knowledgebase or contact our support team.
