Help Center
Home Server & Cloud Infrastructure Cloud Server Important Security Information for Your Server

Disabling SSH root login

Valid for VPS+, VPS, Cloud Servers, Dedicated Servers, and Bare Metal Servers running AlmaLinux 9, AlmaLinux 10, Rocky Linux 9, Rocky Linux 10, Ubuntu 24.04, Ubuntu 26.04, Debian 12, and Debian 13.

This article walks you through disabling login with the root user.

By default, the root account is created as the first account on every Linux system. The root account has the highest privileges. With the root account, you have access to all commands and files and have full read, write, and execute permissions. If this account is used improperly or inappropriately, it can have significant consequences for your server.

Caution

Before disabling SSH root login, make sure that an alternative user with sudo privileges exists and that you can successfully connect via SSH using this user. Otherwise, you will lose administrative access to your server.

Requirement

You have already created an additional user with sudo privileges and verified that this user can log in via SSH. 

To disable the SSH root login:

  • Log in to your server as a user with sudo privileges.

  • Create a backup of the configuration. To do this, enter the following command:

    sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

  • Open the SSH configuration file sshd_config using the vi text editor:

    sudo vi /etc/ssh/sshd_config

    Note
    The vi editor has an insert mode and a command mode. You can enter insert mode by pressing the [i] key. In this mode, the characters you type are inserted into the text immediately. To switch to command mode, press [ESC] afterwards. When using command mode, your keystrokes are interpreted as commands.

  • Look for the line PermitRootLogin yes:

    PermitRootLogin yes

  • Change the entry to PermitRootLogin no and ensure that there is no comment symbol (#) at the beginning of the line.

  • Make sure that this directive does not appear more than once. Remove any duplicate entries if necessary.

  • To exit vi and save the file, enter the following command in command mode and then press the Enter key:

    :wq

  • On many systems, drop-in files in /etc/ssh/sshd_config.d/.conf can override values. To check for these, enter the following command:

    grep -nH "PermitRootLogin" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/.conf 2>/dev/null

  • Before restarting the service, check the configuration file for syntax errors. To do this, enter the following command:

    sshd -t

    If no output is displayed, this means there are no syntax errors.

  • To apply the change, restart the SSH service. To do this, select the appropriate command for your operating system:

    Ubuntu 24.04, Ubuntu 26.04, Debian 12, and Debian 13

    systemctl restart ssh

    Rocky Linux 9, Rocky Linux 10, AlmaLinux 9, and AlmaLinux 10

    systemctl restart sshd

  • To check whether the changes have taken effect, enter the following command:

    sshd -T | grep -i permitrootlogin

Troubleshooting tips

To restore the backed-up configuration, enter the following commands:

Ubuntu 24.04, Ubuntu 26.04, Debian 12, and Debian 13

sudo cp -a /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
sudo sshd -t && systemctl reload ssh

Rocky Linux 9, Rocky Linux 10, AlmaLinux 9, and AlmaLinux and 10

sudo cp -a /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
sudo sshd -t && systemctl reload sshd

Content