In looking at the options for PermitRootLogin, we find that none properly address our needs. We use root login with password between servers in a data center. All of these machines are firewalled. We prefer to leave root login permitted for various infrequent operations (file copies, etc.) but do not want to leave keys on the machine to allow such commands at will (concerns that if one machine is compromised, we would have all machines compromised). So, we'd like to suggest a mechanism that would permit us to specify one or more CIDR blocks as places from which root login is permitted. That way, we can connect into the data center, and then connect among machines as desired, with fewer issues. Please consider this an enhancement request. Were it not for the present pounding our machines take from people trying to break in by guessing passwords, we probably would not even be asking. As a precaution due to the attacks, we have disabled root login entirely, but this is interfering with some of our normal workflow. I'd be happy to answer any questions.
Would something like this in sshd_config do what you want (assuming your cluster addresses are 192.168.0.0/24, untested): DenyUsers root@!192.168.0.*
Ha, thank you. The man page for the AllowUsers and DenyUsers does actually mention this, but it was not at all apparent without an example that a wildcarded IP address would do the trick. Guess this should become a suggestion for the documentation writers to add an example or two. It'd still be nice to permit based on CIDR, but what's there is sufficient for my immediate needs. Again, thanks for pointing this out.
Supporting CIDR notation is an open enhancement request (see bug #976). Note that it may be possible to fool this by faking the reverse DNS resolution to look like an IP address (recent versions specifically check for this).
Change all RESOLVED bug to CLOSED with the exception of the ones fixed post-4.4.