ssh as root with and without private key

[Darren Tucker]

Dave Yost wrote:
[...]
> In sshd_conf I have this
> 
>   Match User rootback
>           PermitRootLogin yes
>           ForceCommand /root/bin/dobackup
>   Match User root
>           PermitRootLogin yes
>   Match

Is there something missing here?

> When I
>   ssh -l rootback host whatever
> it runs the dobackup script.
> 
> However, when I run
>   ssh -l root host date
> it logs me in without asking for a password and runs date.
> 
> So close. But not right.
> 
> Is there a way to get what I want?

You want to disallow public-key authentications for root but not rootback?

Does adding "PubkeyAuthentication no" to the "Match User root" section 
do it?  (You'd probably want to add the other passwordless authmethods 
to the list to, eg rsa (protocol 1) gssapi hostbased rhostsrsa and so 
forth).

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
     Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.