# How to Enable Root Login on Your VM (BYOVM)

Elestio’s **BYOVM (Bring Your Own VM)** workflow requires **direct root-level SSH access** to the target host. Many cloud providers disable or restrict root login by default; this document outlines how to safely re-enable it while maintaining a strong security posture.

<div id="bkmrk-"><div>---

</div></div>#### Architectural Requirement for Root Access

Elestio performs **low-level system provisioning and lifecycle management** directly on the host. This includes:

<div id="bkmrk-writing-configuratio"><div>- Writing configuration and state under `/root/` other privileged paths
- Installing and managing system packages and daemons
- Modifying network configuration, firewall rules, and kernel-adjacent settings
- Executing privileged deployment and orchestration tasks

</div></div>Relying on a non-root user with `sudo` is intentionally avoided due to

<div id="bkmrk-inconsistent-sudo-av"><div>- **Inconsistent `sudo` availability and behavior** across distributions and cloud images
- **Hard dependencies on root-owned paths** (e.g., `/root`, system-level configs)
- **Increased operational complexity** from privilege escalation (TTY requirements, environment differences, edge cases)
- **Higher failure surface** during automated provisioning

</div></div>From an automation and reliability standpoint, **direct root access is deterministic and reduces ambiguity**.

<div id="bkmrk--1"><div>---

</div></div>#### Security Model: Root Access with SSH Keys

Enabling root login is **not inherently insecure** when implemented correctly.

Elestio enforces the following security guarantees:

<div id="bkmrk-password-authenticat"><div>- **Password authentication is permanently disabled**
- **Only SSH key-based authentication is permitted**
- **Root login is restricted to key-based access (`prohibit-password`)**

</div></div>##### Implications

<div id="bkmrk-no-password-based-lo"><div>- No password-based login is possible under any circumstances
- Attack vectors such as brute-force or credential stuffing are eliminated
- Access is strictly limited to holders of the corresponding private key

</div></div>Blocking the root while allowing SSH access to an enabled user does **not materially improve security**. Any compromise of such a user trivially escalates to root (`sudo su`). The **true security boundary is the SSH private key**, not the username.

<div id="bkmrk--2"><div>---

</div></div>##### Step 1: Remove Provider-Imposed Restrictions

Some providers (notably AWS and GCP) inject a forced command `/root/.ssh/authorized_keys` to prevent root login:

```bash
no-port-forwarding,no-agent-forwarding,no-X11-forwarding,command="echo 'Please login as the user \"ubuntu\" rather than the user \"root\".';echo;sleep 10;exit 142"
```

<div id="bkmrk--3"><div></div></div>This must be removed.

Execute as a privileged non-root user (e.g., `ubuntu`, `ec2-user`):

```bash
sudo sed -e "s/echo;sleep 10;exit 142//g" -i /root/.ssh/authorized_keys
```

Validate:

```bash
sudo cat /root/.ssh/authorized_keys
```

Expected state: **only raw public key entries, no `command="..."` prefix**.

<div id="bkmrk--4"><div>---

</div></div>##### Step 2: Configure SSH Daemon

Inspect the current configuration:

```bash
sudo grep -i PermitRootLogin /etc/ssh/sshd_config
```

Enforce the correct policy:

```bash
sudo sed -i 's/^.*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
```

##### Semantics

<div id="bkmrk-prohibit-password-%E2%9C%85-"><div>- `prohibit-password`
    
    
    - ✅ (allows) SSH key authentication
    - ❌ (blocks) password authentication

</div></div>This is the **recommended and secure baseline configuration**.

<div id="bkmrk--5"><div>---

</div></div>##### Step 3: Reload SSH Service

Apply changes without terminating the active session:

```bash
sudo systemctl reload sshd || sudo service ssh reload
```

<div id="bkmrk--6"><div>---

</div></div>##### Step 4: Validate Root Access

From your local environment:

```bash
ssh -i /path/to/private_key root@<server_ip>
```

A successful connection should yield a root shell immediately.

<div id="bkmrk--7"><div>---

</div></div>##### Provider Behavior Matrix

<div id="bkmrk-provider-root-access"><div><table><thead><tr><th>Provider</th><th>Root Access Default</th><th>Notes</th></tr></thead><tbody><tr><td>AWS EC2 (Ubuntu)</td><td>Blocked</td><td>Requires `authorized_keys` fix</td></tr><tr><td>AWS EC2 (Amazon Linux)</td><td>Blocked</td><td>Requires `authorized_keys` fix</td></tr><tr><td>Google Cloud</td><td>Blocked</td><td>Requires `authorized_keys` fix</td></tr><tr><td>Azure</td><td>Blocked</td><td>Controlled via `sshd_config`</td></tr><tr><td>DigitalOcean</td><td>Enabled</td><td>No action required</td></tr><tr><td>Hetzner</td><td>Enabled</td><td>No action required</td></tr><tr><td>Vultr</td><td>Enabled</td><td>No action required</td></tr><tr><td>Linode (Akamai)</td><td>Enabled</td><td>No action required</td></tr></tbody></table>

</div></div>For AWS and GCP, **Step 1 is mandatory** in most cases.

<div id="bkmrk--8"><div>---

</div></div>##### Troubleshooting

##### Root login still denied

Check for override files:

```bash
sudo grep -r PermitRootLogin /etc/ssh/sshd_config.d/
```

Ensure all instances are set to:

```text
PermitRootLogin prohibit-password
```

<div id="bkmrk--9"><div>---

</div></div>##### Forced “login as ubuntu” message

Indicates the provider-injected restriction is still present.

Re-run Step 1 and re-validate `/root/.ssh/authorized_keys`.

<div id="bkmrk--10"><div>---

</div></div>##### SSH key not accepted

Ensure the key exists and permissions are correct:

```bash
sudo cat /root/.ssh/authorized_keys
```

If missing:

```bash
sudo cp ~/.ssh/authorized_keys /root/.ssh/authorized_keys
sudo chmod 600 /root/.ssh/authorized_keys
sudo chown root:root /root/.ssh/authorized_keys
```

<div id="bkmrk--11"><div>---

</div></div>##### Consolidated Execution Block

```bash
# Remove provider-enforced root restriction
sudo sed -e "s/echo;sleep 10;exit 142//g" -i /root/.ssh/authorized_keys

# Enable root login via SSH key only
sudo sed -i 's/^.*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config

# Normalize any drop-in overrides
sudo sed -i 's/^.*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config.d/*.conf 2>/dev/null || true

# Reload SSH daemon
sudo systemctl reload sshd || sudo service ssh reload
```