Pam + Ssh Keys

[BrianCarpio]

I know I can use PAM and the access.conf file to restrict root SSH logins from specific IP addresses, so I want to do that but I also want ROOT to only be able to login VIA ssh using a trusted ssh_key (authorized_keys) and not a password, the only way to SSH log onto the box using the ROOT password should be via the console or via su - . This should only be for the ROOT user and not for other users.

[anomie]

I also want ROOT to only be able to login VIA ssh using a trusted ssh_key (authorized_keys) and not a password

In /etc/ssh/sshd_config:

PermitRootLogin without-password

See sshd_config(5) manpages for details.

the only way to SSH log onto the box using the ROOT password should be via the console or via su - . This should only be for the ROOT user and not for other users.

Edit /etc/securetty and remove everything except the line that says "console". (IIRC, in this context, console refers to single-user mode console -- you'll want to test that.)