According to pkg-message: "'PermitRootLogin no' is the default for the OpenSSH port. This now matches the PermitRootLogin configuration of OpenSSH in the base system. Please be aware of this when upgrading your OpenSSH port, and if truly necessary, re-enable remote root login by readjusting this option in your sshd_config." Its wrong: by default PermitRootLogin is set to "prohibit-password" ("without-password" synonym), since... 2015. # pkg install openssh-portable [...] # /usr/local/sbin/sshd -T | grep -i root permitrootlogin without-password chrootdirectory none IMHO, to keep ports/base consistent, sshd_config should be patched to set PermitRootLogin to "no", and a notice in UPDATING added.
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=fad4f7d3cf4db1a8cf6a748c0bdc9d6d0b3321a1 commit fad4f7d3cf4db1a8cf6a748c0bdc9d6d0b3321a1 Author: Bryan Drewery <bdrewery@FreeBSD.org> AuthorDate: 2026-04-25 23:19:30 +0000 Commit: Bryan Drewery <bdrewery@FreeBSD.org> CommitDate: 2026-04-25 23:35:14 +0000 security/openssh-portable: Fix PermitRootLogin default to "no" This matches what is reported in pkg-message. PR: 267170 Reported by: SimpleRezo UPDATING | 6 ++++-- security/openssh-portable/Makefile | 2 +- security/openssh-portable/files/patch-servconf.c | 19 ++++++++++++++----- security/openssh-portable/files/patch-sshd_config.5 | 19 ++++++++++++++----- 4 files changed, 33 insertions(+), 13 deletions(-)
Thanks for alerting me to this. The default has been fixed to "no".