For routine administration, do not SSH directly as root. Log in with a named account authenticated by a public key, grant that account only the sudo rights it needs, keep a provider recovery path, test a second session, and then set PermitRootLogin no. This blocks root authentication through OpenSSH while preserving root-level administration through sudo (and, where configured, su) after a successful login.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The sequence matters more than the single configuration line. If you disable root SSH before creating and testing another administrative path, a typo in a key, username, firewall rule, or SSH configuration can lock you out.
As an Amazon Associate I earn from qualifying purchases.
Why direct root SSH is the wrong routine default
The root account can change every part of a Linux system: users, services, firewalls, files, packages, and authentication policy. A direct root session therefore combines identity and maximum privilege in one login. Anyone who obtains that account’s SSH credential, or exploits a weakness in a service that exposes the account, starts at the highest privilege level instead of having to cross a separate elevation boundary.
A named account creates an individual audit trail and a narrower first step. You authenticate as the person or service that is connecting, then request elevated privileges for a specific command through sudo. That separation does not make a compromised account harmless, and it is not a substitute for patching, key protection, or least-privilege sudo rules. It does remove routine dependence on a single, universally named administrator account.
#1 Best Overall
Red Hat’s security guidance recommends changing the SSH daemon setting to PermitRootLogin no to prevent root logins through SSH. The OpenSSH manual defines the same option: when it is set to no, root is not allowed to log in. The restriction applies to SSH protocols, including interactive SSH and file-transfer sessions made as root; it does not delete the root account or remove sudo and su for an administrator who has already authenticated through another account.
What PermitRootLogin actually controls
PermitRootLogin is an OpenSSH daemon policy. It governs whether the root account may authenticate over SSH and, for some values, which authentication methods are permitted. It does not control local console logins, provider recovery consoles, or the privileges of a non-root user after that user has logged in.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →| Setting | Effect on root over SSH | Appropriate use | Important limitation |
|---|---|---|---|
no |
Disallows root login through OpenSSH, including root password and key authentication. | Best default for routine administration when a tested named sudo account exists. | You must retain another administrative path before applying it. |
prohibit-password |
Disables root password and keyboard-interactive authentication but may still permit root public-key authentication. | Environments that deliberately require a tightly controlled root key for a documented reason. | It is not equivalent to disabling root SSH. A valid root key can still work. |
forced-commands-only |
Allows root public-key authentication only when the key specifies a forced command. | Constrained automation such as a backup key that must run one command. | It is unsuitable for interactive administration and requires careful key restrictions. |
Defaults differ by distribution. Debian’s current sshd_config manual documents prohibit-password as its default. Ubuntu documents that its administrative root account is disabled by default and describes controlling SSH access through normal users and groups. A tutorial written for one image cannot tell you the effective policy on another VPS.
Inspect the effective policy instead of trusting a comment
Distribution files often contain commented examples, and providers may add configuration fragments in an include directory. On a system where you have administrative access, inspect the daemon’s effective configuration with the OpenSSH configuration-test/effective-setting tools supported by that distribution. A line that appears in /etc/ssh/sshd_config may be overridden later, or an included file may take precedence. Check the active value of permitrootlogin, the allowed users or groups, and the authentication methods before making a change.
The safe order of operations
Use this order on every VPS, regardless of whether the initial login is supplied by a cloud image, hosting provider, or recovery console:
- Keep the original session open. Do not close the working root or provider session while making and testing changes.
- Create a named account. Choose an account that identifies a person or a tightly scoped service, rather than sharing one administrator login.
- Grant the minimum elevation required. On distributions that use a sudo administrator group, add the account to that group; for narrower tasks, use a command-specific sudo rule instead.
- Install the public key for the named account. Put the public key in that account’s own
~/.ssh/authorized_keys, with the correct owner and restrictive permissions. - Open a second terminal and test a new SSH connection. Verify key authentication, the account’s home directory, and a harmless sudo command before changing the daemon policy.
- Validate the SSH configuration. Run the distribution-supported syntax check while the original session remains available. Do not reload a daemon that reports an error.
- Reload SSH only after the second session works. A reload lets existing sessions continue while the daemon applies the new policy; service names differ between distributions.
- Disable root SSH. Set
PermitRootLogin no, validate again, reload, and test the named account once more.
Worked example: Ubuntu 24.04 LTS cloud image
The following is an example for an Ubuntu 24.04 LTS server using the conventional sudo group and the ssh systemd service. Provider images can add their own users or SSH include files, so adapt the account name and key to your image. Do not paste these commands into a Debian or RHEL host without checking that distribution’s account and service conventions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minute1. Create the administrative account
From the still-open provider or root session, create a named account. In this example the account is called opsadmin; replace it with a name that reflects your own identity policy.
adduser opsadmin
usermod -aG sudo opsadminadduser creates the home directory and prompts for an account password. The password is not a replacement for a public key; it is useful for local recovery or for the sudo policy you choose. If your organization requires a locked password for key-only administration, lock it only after key login and sudo have been tested.
2. Install the key on the named account
Copy the public half of the administrator’s SSH key into /home/opsadmin/.ssh/authorized_keys. The private key stays on the administrator’s client device and must never be copied to the VPS. A typical server-side sequence is:
install -d -m 700 -o opsadmin -g opsadmin /home/opsadmin/.ssh
install -m 600 -o opsadmin -g opsadmin /dev/null /home/opsadmin/.ssh/authorized_keys
cat /path/to/opsadmin_ed25519.pub >> /home/opsadmin/.ssh/authorized_keysThe final command assumes the public-key file is available in the current session. If you use a provider’s key-import function or ssh-copy-id, confirm that it wrote to the new account, not to /root. The directory must be owned by the named account, and both the directory and file must be writable only as appropriate for SSH’s strict permission checks. A key placed in root’s authorized_keys does not authenticate opsadmin.
Recommended Free Tools
3. Test a second SSH connection
Leave the first terminal open. In a separate terminal on your client, connect explicitly as the new account and select the matching private key:
ssh -i ~/.ssh/opsadmin_ed25519 opsadmin@your-server-addressAfter login, verify identity and sudo without changing anything:
Rank #3
whoami
sudo -v
sudo idwhoami should report opsadmin. A successful sudo -v refreshes the sudo credential, and sudo id should show effective user ID 0 if the account has the expected administrative grant. If any command fails, fix the account, key, ownership, or sudo policy while the original session is still open.
4. Optionally lock the account password
Ubuntu’s security example combines a normal user, sudo membership, an authorized public key, a locked password, and PermitRootLogin no. If your threat model calls for key-only access, you can lock the password for the named account after confirming that key login works:
Free tools Windows power users keep installed
One-click scans. No signup required.
passwd -l opsadminLocking a password does not remove an already installed public key from authorized_keys. It also does not by itself prevent every other authentication method or change the SSH daemon’s account and group rules, so treat it as one part of the policy rather than the complete configuration.
5. Validate and reload the daemon
Edit the SSH daemon configuration using the editor and file layout supplied by your Ubuntu image. Add or change the effective directive to:
PermitRootLogin noBefore reloading, run the supported syntax check for the installed OpenSSH package. On Ubuntu this is commonly the daemon’s -t test mode invoked with the service’s configuration; use the command documented for the image if it differs. A successful check should return without an error. If it reports an unknown keyword, malformed value, permission problem, or included-file failure, restore the previous configuration in the original session and correct the error before proceeding.
Once the check succeeds and the second terminal is still connected, reload the SSH service using the Ubuntu service name:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
systemctl reload sshOpen a third connection as opsadmin and confirm that it still works. Then, from a separate test, confirm that a direct root SSH attempt is rejected. Do not use a failed root test as your only recovery test; the named account and provider console are the paths you need to keep functional.
How the procedure differs on Debian, RHEL, and provider images
The security goal is portable, but command names, default users, service units, and configuration fragments are not.
- Debian: The current Debian manual documents
prohibit-passwordas the default root-login policy. Read the effective configuration before assuming root keys are blocked. Debian systems commonly use asudogroup when the package is installed, but the image may define a different administrative arrangement. - Ubuntu: The administrative root account is disabled by default in the documented Ubuntu model. Cloud images often create a first non-root user with sudo access, so check whether that account already provides the tested recovery path before creating another.
- RHEL-family systems: The administrative group and service unit may differ from Ubuntu’s. Red Hat’s guidance specifically describes editing
/etc/ssh/sshd_configand settingPermitRootLogin no; use the distribution’s supported syntax check and reload command, commonly associated with ansshdservice, rather than copying Ubuntu’ssshcommand blindly. - Managed or cloud images: Provider startup agents can regenerate users, keys, or SSH fragments. A change that works in the main file may be superseded by an included file or image-management tool. Record the provider’s recovery-console procedure before changing access.
These differences are why an effective-configuration inspection and a tested second login are more reliable than a universal copy-and-paste recipe.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Recovery planning: how to avoid locking yourself out
Keep two independent paths
The first path is the named SSH account and its public key. The second should be a provider console, out-of-band serial console, rescue environment, or another documented administrative route. A second SSH session to the same account is an essential test, but it is not independent if the same firewall rule, key, network path, or daemon configuration can break both sessions.
If the new login fails before you disable root
- Keep the original session open and inspect
authorized_keysfor the correct key, account, owner, and mode. - Confirm that the client is offering the matching private key and that the username is the new account, not root.
- Check the account’s shell, home-directory path, and group membership.
- Review SSH authentication logs through the distribution’s normal system log facility.
- Run the daemon’s configuration test and correct any syntax or include-file error.
If you already set PermitRootLogin no and lost SSH access
Use the provider recovery console or rescue environment. Restore a known-good SSH configuration, repair the named user’s key and permissions, and run the syntax check before restarting or reloading the daemon. Existing sessions may remain usable after a reload, so do not terminate a surviving console until the replacement path has been proven. If no out-of-band path exists, the provider’s documented recovery procedure is the only supported route; plan that access before making the change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Authentication choices beyond the root-login switch
Disabling root SSH addresses one account. It does not automatically require public-key authentication for every user, disable weak methods, restrict who may connect, or add multi-factor authentication. Decide those controls separately according to your distribution and threat model.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Password and keyboard-interactive authentication
prohibit-password demonstrates an important distinction: a policy can remove root passwords while still allowing root public-key authentication. If your goal is to prevent all direct root SSH, use no, not a setting that merely changes the root authentication method. Likewise, locking an account password does not remove keys already authorized for that account.
Public keys on named accounts
Place each administrator’s public key on that administrator’s named account. Do not share one private key among a team when individual keys can provide accountability and independent revocation. Remove a former administrator’s key from that account without affecting other users, and keep a documented spare recovery key under controlled custody if your policy requires one.
Sudo scope and session behavior
Membership in a broad administrator group usually permits extensive root-equivalent actions. For service accounts, consider a sudo rule limited to the exact command and arguments required. For human administrators, use sudo for deliberate elevation and review the resulting logs. The fact that sudo can become root is not an argument for direct root SSH; it is the reason to control and audit the elevation step.
Automation and forced-commands-only
Some automation genuinely needs a root-owned operation, such as a backup receiver. In that case, a dedicated key with a forced command can be safer than an interactive root key. The OpenSSH manual’s forced-commands-only mode permits root public-key authentication only when a forced command is specified. Constrain the key further where supported, test the exact command, and never use this mode as a substitute for a named interactive administrator account.
Common mistakes and their fixes
| Mistake | Why it happens | Fix |
|---|---|---|
Changing PermitRootLogin before creating another user |
The administrator assumes the current root session proves future access. | Create, key, and test the named account first; retain the original session until the new one works. |
Using prohibit-password while intending to block root completely |
The setting sounds like a full root-login ban. | Use PermitRootLogin no when all direct root SSH must be denied. |
Installing the key under /root |
Key-copy tools default to the account used for the current session. | Verify the named account’s home directory, ownership, and authorized_keys path. |
| Overly permissive SSH-file modes | Files copied as root retain root ownership or group/world write access. | Set the .ssh directory and key file to the named user’s ownership with restrictive modes. |
| Reloading after an unchecked edit | A typo or bad include file prevents the daemon from accepting the configuration. | Run the supported syntax test first and keep a recovery session open. |
| Assuming sudo disappears when root SSH is disabled | The administrator confuses an SSH authentication rule with account deletion. | Continue logging in as the named user and use sudo; test it before the change. |
| Copying Ubuntu service commands to another distribution | Service units and administrative groups differ. | Use the target distribution’s documented service name, group, and validation command. |
A practical decision framework
Choose the policy that matches the access you can operate safely, not merely the shortest configuration line.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches| Situation | Recommended policy | Operational requirement |
|---|---|---|
| Human administration of a normal VPS | Named account, public key, sudo, and PermitRootLogin no. |
At least one tested second session and a documented provider recovery path. |
| Legacy workflow currently uses a root key | Create and test a named account first; migrate the workflow before disabling root. | Identify every script, file-transfer job, and monitoring check that authenticates as root. |
| Constrained backup or deployment automation | Dedicated key with a forced command, potentially under forced-commands-only. |
Restrict the command and test failure behavior; do not use it for interactive work. |
| Uncertain image or provider defaults | Inspect effective SSH settings and existing users before editing. | Use the provider console as the independent recovery channel. |
Final checklist before you disable root SSH
- A named account exists and identifies the administrator or service.
- The account’s public key is in that account’s own
authorized_keysfile. - Ownership and permissions on the home and SSH directories pass the daemon’s checks.
- The account has the minimum sudo access required, and
sudohas been tested. - A second terminal has logged in successfully without using root.
- The effective SSH configuration has been inspected, including included files.
- The daemon configuration syntax test succeeds.
- The provider console or another independent recovery path is documented and available.
- You understand whether your distribution uses
sshorsshdas the service unit and which file controls the active policy. - Only then is
PermitRootLogin noapplied and the daemon reloaded.
The resulting workflow is straightforward: authenticate as an individual, elevate only when necessary, and reserve root for the command that needs it rather than making root the identity of every SSH session. That arrangement improves accountability and recoverability while preserving the administrative power you need.
Frequently Asked Questions
Will setting PermitRootLogin no delete or disable the root account?
No. It blocks root authentication through OpenSSH. Root remains available through permitted local or recovery mechanisms, and a successfully authenticated administrator can still use sudo or su when the system policy allows it.
Can I disable the password for an account and still use its SSH key?
Yes. Locking an account password does not remove a public key already present in that account’s authorized_keys. Test key login before locking the password.
Is prohibit-password as safe as no?
They enforce different policies. prohibit-password blocks root password and keyboard-interactive authentication but can still allow a root public key. no blocks root SSH authentication altogether.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
