What does 'without password' mean in sshd_config file?

From the manpage:

PermitRootLogin

Specifies whether root can log in using ssh(1). The argument must be “yes”, “without-password”, “forced-commands-only”, or "no”. The default is “yes”.

If this option is set to “without-password”, password authentication is disabled for root.

If this option is set to “forced-commands-only”, root login with public key authentication will be allowed, but only if the command option has been specified (which may be useful for taking remote backups even if root login is normally not allowed). All other authentication methods are disabled for root.

If this option is set to “no”, root is not allowed to log in.

Thus without-password allows root login only with public key authentication. This is often used with shell scripts and automated tasks.

Actually this setting does pretty much nothing if you are using PAM authentication. At the bottom of the sshd_config configuration file you will find:

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.

The default setting on Ubuntu is to use PAM authentication:

UsePAM yes

In newer versions of sshd (OpenSSH 7.0 and above, released on 2015-08-11) "without-password" has been changed to "prohibit-password".

Both version work, probably best to use "prohibit-password" if you can: it explains itself better.

Source:

• sshd_config(5): PermitRootLogin now accepts an argument of 'prohibit-password' as a less-ambiguous synonym of 'without-password'.

Note that there are legitimate reasons for logging in via root (but using cryptographic keys and never a password). A typical example is remotely syncing two servers (to have one of them being used as fail-over). Because the structure must be identical, often a root password is required.

Here is an example using unison for the synchronisation.