diff --git a/modules/openstack_project/manifests/single_use_slave.pp b/modules/openstack_project/manifests/single_use_slave.pp
index df7c227e4e..b268de3c66 100644
--- a/modules/openstack_project/manifests/single_use_slave.pp
+++ b/modules/openstack_project/manifests/single_use_slave.pp
@@ -26,6 +26,7 @@ class openstack_project::single_use_slave (
     install_users             => $install_users,
     install_resolv_conf       => $install_resolv_conf,
     enable_unbound            => $enable_unbound,
+    permit_root_login         => 'yes',
     iptables_rules4           =>
       [
         # Ports 69 and 6385 allow to allow ironic VM nodes to reach tftp and
diff --git a/modules/openstack_project/manifests/template.pp b/modules/openstack_project/manifests/template.pp
index 7e50f47f24..d31f81759a 100644
--- a/modules/openstack_project/manifests/template.pp
+++ b/modules/openstack_project/manifests/template.pp
@@ -21,6 +21,7 @@ class openstack_project::template (
   $sysadmins                 = [],
   $pypi_index_url            = 'https://pypi.python.org/simple',
   $purge_apt_sources         = false,
+  $permit_root_login         = 'no',
 ) {
 
   ###########################################################
@@ -35,6 +36,7 @@ class openstack_project::template (
 
   class { 'ssh':
     trusted_ssh_source => $puppetmaster_server,
+    permit_root_login => $permit_root_login,
   }
 
   if ( $afs ) {