Want to keep root login disabled while still using the cPFence WebUI? follow the recommended steps below:
Recommended SSH Configuration
There are two supported ways to secure SSH while keeping cPFence WebUI working.
- Option 1 (Recommended): Allow root SSH only from specific IPs (more secure).
- Option 2 (Simpler): Good if you already allow root login and want to harden it a bit.
Warning: Before reloading SSH, make sure your main control panel IPv4/IPv6 is correct and that you can SSH as root using your key from the main control panel server. Otherwise, you may lock yourself out.
Option 1 (Recommended): Restrict Root SSH by IP
Root SSH access is blocked everywhere except from trusted IP addresses. This is the most secure option.
Important: You must add the public IPv4 and IPv6 of your main control panel server (the server that connects to managed servers via SSH).
Quick Steps
1) Create a hardening file that loads first
sudo tee /etc/ssh/sshd_config.d/01-cpfence-hardening.conf >/dev/null <<'CONF'
PubkeyAuthentication yes
# default: root NOT allowed
PermitRootLogin no
# allow root key login ONLY from trusted IPs
Match User root Address <Main_CP_IPV4_1>,<Main_CP_IPV6_1>
PermitRootLogin prohibit-password
# end Match block
Match all
CONF
2) Validate and reload SSH
sudo sshd -t && sudo systemctl reload ssh
3) Quick check (allowed vs blocked)
From an allowed IP:
sudo sshd -T -C user=root,addr=<Main_CP_IPV4_1> | grep -i permitrootlogin
Expected:
permitrootlogin without-password (or prohibit-password)
From a non-allowed IP:
sudo sshd -T -C user=root,addr=8.8.8.8 | grep -i permitrootlogin
Expected:
permitrootlogin no
Option 2 (Simpler): No IP Restrictions
This option is good if you already allow root login and want to harden it a bit. Root SSH access using keys is allowed from anywhere, while root login with passwords is prohibited.
Quick Steps
1) Create a hardening file that loads first
sudo tee /etc/ssh/sshd_config.d/01-cpfence-hardening.conf >/dev/null <<'CONF'
PermitRootLogin prohibit-password
PubkeyAuthentication yes
CONF
2) Validate and reload SSH
sudo sshd -t && sudo systemctl reload ssh
3) Quick check
sudo sshd -T | grep -E 'permitrootlogin|pubkeyauthentication'
Expected
permitrootlogin without-password (or prohibit-password)
pubkeyauthentication yes
Rollback (Both Options)
sudo rm /etc/ssh/sshd_config.d/01-cpfence-hardening.conf
sudo systemctl reload ssh
Notes
- Ubuntu reads
/etc/ssh/sshd_config.d/*.confin order. Using01-...ensures this file is applied first. - Seeing
without-passwordis normal. It is the canonical alias ofprohibit-password.
Need help?
Visit our Knowledgebase or contact our support team.
