ssh:disable-root-login

Direct root logins over SSH put the most privileged account on the network-facing authentication path. Disabling them keeps routine access tied to named administrator accounts, so a stolen root key or guessed root password cannot open an interactive root session directly.

OpenSSH controls this behavior with the PermitRootLogin directive in the server configuration. Setting it to no blocks root for every authentication method, while the common default prohibit-password still allows root public-key login unless another policy prevents it.

On Debian and Ubuntu, files under /etc/ssh/sshd_config.d/*.conf are included at the start of /etc/ssh/sshd_config, and the first value read for most directives wins. Keep a working non-root SSH session open, validate the syntax before applying the change, and check the effective policy for user=root before closing the recovery path.

Confirm a non-root administrator account can log in before changing the daemon policy.
```
$ ssh admin@server.example.net whoami
admin
```
Keep this session open until root denial and normal administrator access are both confirmed from a new connection.

Back up the current SSH daemon configuration file.

$ sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

Open an early local drop-in for the root-login policy.
```
$ sudo vi /etc/ssh/sshd_config.d/00-disable-root-login.conf
```
Use the active server configuration file instead when /etc/ssh/sshd_config does not include /etc/ssh/sshd_config.d/*.conf.
Set PermitRootLogin to no.
```
PermitRootLogin no
```
PermitRootLogin no blocks direct root login by password, keyboard-interactive, public key, and forced command.
Test the SSH daemon configuration syntax.
```
$ sudo sshd -t
```
No output means the active configuration parsed successfully.

Related: How to test SSH server configuration
Check the effective root-login policy that sshd will apply.
```
$ sudo sshd -T -C user=root,host=client.example.net,addr=203.0.113.10 | grep '^permitrootlogin '
permitrootlogin no
```
Replace client.example.net and 203.0.113.10 when Match rules depend on the client's resolved host name, source address, or user.
Reload the SSH service to apply the policy.
```
$ sudo systemctl reload ssh
```
Use sshd instead of ssh on distributions that package the server as sshd.service.
Related: How to manage the SSH server service with systemctl
Confirm the SSH service is still active.
```
$ sudo systemctl is-active ssh
active
```
Confirm the non-root administrator account still logs in from a new session.
```
$ ssh admin@server.example.net whoami
admin
```
Related: How to log in to an SSH server from Linux
Test direct root login from a separate client session.
```
$ ssh -o BatchMode=yes root@server.example.net whoami
root@server.example.net: Permission denied (publickey).
```
The authentication method list can differ by server policy; the important result is that root cannot authenticate directly.

How to disable SSH root login

Steps to disable SSH root login: