How to disable root SSH login

Quick answer: Create a regular user with sudo rights, install your SSH key for that user, then set PermitRootLogin no in /etc/ssh/sshd_config and restart SSH. From then on you log in as the user and use sudo for administration — bots brute-forcing "root" hit a dead end.

Overview

Every Linux server has a root account, so attackers already know half of the credential pair. Disabling direct root SSH login forces them to guess both a username and a key or password, and it gives you an audit trail: actions are tied to a named user instead of everyone sharing root.

Before you start

• Root access to the server.
• Your SSH public key at hand (how to set up SSH keys).
• KVM Console access from the Client Area in case something goes wrong.

Step-by-step guide

1. Create an admin user and add it to the sudo group:

   adduser deploy
   usermod -aG sudo deploy    # Ubuntu/Debian
   usermod -aG wheel deploy   # AlmaLinux/Rocky

2. Install your public key for the new user:

   mkdir -p /home/deploy/.ssh
   cp /root/.ssh/authorized_keys /home/deploy/.ssh/
   chown -R deploy:deploy /home/deploy/.ssh
   chmod 700 /home/deploy/.ssh
   chmod 600 /home/deploy/.ssh/authorized_keys

3. Test the new login in a NEW terminal and confirm sudo -i works.
4. Disable root login in /etc/ssh/sshd_config:

   PermitRootLogin no

5. Restart SSH: systemctl restart ssh (Ubuntu/Debian) or systemctl restart sshd (Alma/Rocky).

Common issues

• sudo asks for a password you don't know: set one first with passwd deploy, or configure key-only sudo policies deliberately.
• Automation scripts break: update deploy tools and cron jobs that connected as root to use the new user.
• Locked out: the KVM Console logs in locally as root regardless of SSH settings — fix the config there.

When to contact support

If the KVM Console is unavailable or you cannot regain access after a config mistake, open a support ticket with your service ID and what you changed.

Frequently asked questions

Why disable root login if my password is strong?

Attackers already know the username root, so half the credential pair is public. Forcing a named user plus sudo makes guessing harder and gives you a per-person audit trail in the logs.

Can I still become root after disabling root SSH?

Yes. Log in as your admin user and run sudo -i for a full root shell. Direct root access also remains available locally through the KVM Console in the Client Area at any time.

Related articles

• How to secure SSH access
• How to set up SSH keys
• VPS security checklist after deployment
• How to read auth logs

Need a hand? Contact Cloud2Y support →