>

Disable root SSH login on your server

One of the first hardening steps: no more direct root connections from the internet.

LinuxsshsshdhardeningsecurityMedium risk
Set PermitRootLogin no in /etc/ssh/sshd_config and restart sshd — root can no longer connect directly; log in as your user and use sudo.

01Command

Command
$ sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config && sudo systemctl restart sshd

02What it does

Bots constantly hammer root@ on any public SSH port, and PermitRootLogin no removes that target entirely: attackers must now also guess a valid username. You still have full admin access by logging in as a normal user and running sudo, so nothing is lost. Restart sshd to apply, and validate the config with sshd -t first so a typo doesn't break startup.

03Risk

RiskMedium risk
RequirementsOpenSSH server installed; test with sudo sshd -t before restarting (see sshd-config-test)
!Warning: Confirm you can sudo from your normal account BEFORE closing your current session — on a remote box this is the classic way to lock yourself out; use sshd-config-test to validate the file first.

04Undo

Undo
$ sudo sed -i 's/^PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_config && sudo systemctl restart sshd

05Sources

  • sshd_config(5) — Linux manual page
    man7.org · community · 2026-09-17
    Evidence: PermitRootLogin no prevents root from logging in directly via SSH; changes require restarting sshd to take effect.
  • SecuringDebianHowto — Debian Wiki
    Debian · community · 2026-09-17
    Evidence: Disabling direct root SSH login is a core hardening step; administrators should log in as a normal user and use sudo instead.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Create an SSH key pair with ssh-keygen (Ed25519)
LinuxTerminaldevelopersecurity

Generate a modern Ed25519 public/private key pair in ~/.ssh for authenticating to servers and Git platforms without passwords.

Low risk ✓ 2026-09-17
Change file permissions with chmod
LinuxFilesTerminalsecurity

Add or remove read, write, and execute permission for the owner, group, or others using symbolic or octal modes.

Medium risk ✓ 2026-09-17
Allow a port through the firewall with ufw
Linuxnetworksecurity

Add a UFW rule to permit inbound traffic on a TCP or UDP port, such as SSH on port 22.

High risk ✓ 2026-09-17