Direct root logins over SSH put the most privileged account on the network-facing authentication path. Disabling them keeps routine access tied to named administrator accounts, so a stolen root key or guessed root password cannot open an interactive root session directly.
OpenSSH controls this behavior with the PermitRootLogin directive in the server configuration. Setting it to no blocks root for every authentication method, while the common default prohibit-password still allows root public-key login unless another policy prevents it.
On Debian and Ubuntu, files under /etc/ssh/sshd_config.d/*.conf are included at the start of /etc/ssh/sshd_config, and the first value read for most directives wins. Keep a working non-root SSH session open, validate the syntax before applying the change, and check the effective policy for user=root before closing the recovery path.
Steps to disable SSH root login:
- Confirm a non-root administrator account can log in before changing the daemon policy.
$ ssh admin@server.example.net whoami admin
Keep this session open until root denial and normal administrator access are both confirmed from a new connection.
- Back up the current SSH daemon configuration file.
$ sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
- Open an early local drop-in for the root-login policy.
$ sudo vi /etc/ssh/sshd_config.d/00-disable-root-login.conf
Use the active server configuration file instead when /etc/ssh/sshd_config does not include /etc/ssh/sshd_config.d/*.conf.
- Set PermitRootLogin to no.
PermitRootLogin no
PermitRootLogin no blocks direct root login by password, keyboard-interactive, public key, and forced command.
- Test the SSH daemon configuration syntax.
$ sudo sshd -t
No output means the active configuration parsed successfully.
Related: How to test SSH server configuration
- Check the effective root-login policy that sshd will apply.
$ sudo sshd -T -C user=root,host=client.example.net,addr=203.0.113.10 | grep '^permitrootlogin ' permitrootlogin no
Replace client.example.net and 203.0.113.10 when Match rules depend on the client's resolved host name, source address, or user.
- Reload the SSH service to apply the policy.
$ sudo systemctl reload ssh
Use sshd instead of ssh on distributions that package the server as sshd.service.
Related: How to manage the SSH server service with systemctl - Confirm the SSH service is still active.
$ sudo systemctl is-active ssh active
- Confirm the non-root administrator account still logs in from a new session.
$ ssh admin@server.example.net whoami admin
- Test direct root login from a separate client session.
$ ssh -o BatchMode=yes root@server.example.net whoami root@server.example.net: Permission denied (publickey).
The authentication method list can differ by server policy; the important result is that root cannot authenticate directly.
Mohd Shakir Zakaria is a cloud architect with deep roots in software development and open-source advocacy. Certified in AWS, Red Hat, VMware, ITIL, and Linux, he specializes in designing and managing robust cloud and on-premises infrastructures.
