Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →For routine administration, do not SSH directly as root. Use an individual, non-root account authenticated with a public key, grant it only the sudo access it needs, keep a tested recovery route, and then set PermitRootLogin no. That setting blocks root authentication through SSH while leaving root-level administration available through sudo (or su) after a successful login.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest order matters: create and test the replacement account first, validate the SSH configuration, keep your original provider or root session open, and only then reload SSH and disable root login.
As an Amazon Associate I earn from qualifying purchases.
Why routine root SSH is a poor default
A direct root session combines authentication and unlimited authority in one account. Anyone who obtains that account’s password or private key can immediately change system files, create users, install software, read data, or erase logs. It also removes an important operational distinction: a log entry for a named administrator tells you who performed an action, while a shared root login does not provide the same accountability.
A named account with sudo separates those two jobs. SSH authenticates the person or service as an individual account. Sudo then records and authorizes an explicit elevation to root for the commands that require it. You can revoke one person’s key or account without changing every administrator’s credentials, and you can grant narrower privileges when full root access is unnecessary.
#1 Best Overall
This is a risk-reduction design, not a claim that sudo makes a compromised account harmless. An account with unrestricted sudo can still become root. The improvement is that root is no longer the exposed SSH identity, key-based authentication can be required on the named account, and administrative actions can be attributed and controlled.
What PermitRootLogin actually controls
OpenSSH’s PermitRootLogin directive controls whether the root account may authenticate through SSH. With no, root is not allowed to log in over SSH. That blocks SSH, SCP, and SFTP sessions authenticated as root; it does not disable the root account itself, remove sudo, or prevent an already authenticated administrator from using sudo or su.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Setting | Root authentication behavior | Appropriate use |
|---|---|---|
no |
Disallows root login through SSH, regardless of the root authentication method. | Routine interactive administration when a named sudo account and recovery path are ready. |
prohibit-password |
Disallows root password and keyboard-interactive authentication but can still permit root public-key authentication. | A transitional or tightly controlled policy when a specific root key-based workflow is deliberately retained. |
forced-commands-only |
Allows root public-key authentication only when the key specifies a forced command; it is not an interactive root-login policy. | Constrained automation such as a backup key that must run one predetermined command. |
Do not assume the default on one distribution is the default on another. Debian’s current sshd_config manual documents prohibit-password as its default. Ubuntu documents that its administrative root account is disabled by default and provides user and group controls for SSH access. A cloud image may add its own configuration snippets. Inspect the effective policy on the VPS you are actually changing.
Prerequisites before you change SSH
- A currently working provider console, recovery console, or root session that you will leave open until the new login has been tested.
- A named account for each human administrator rather than one shared administrative identity.
- A public/private key pair on the administrator’s workstation. Install only the public key on the VPS; keep the private key off the server and protect it locally.
- A clear record of the VPS distribution and release. The example below is for Ubuntu 24.04 LTS; package names, service names, group names, and configuration layout can differ on Debian, RHEL-derived systems, and provider images.
- A maintenance window or rollback plan if the daemon rejects a configuration change.
Set up a named sudo account on Ubuntu 24.04 LTS
The following sequence assumes you are still connected through the provider’s initial root session or another trusted administrative channel. Substitute your own account name; adminops is only an example.
1. Create the account and grant the required administrative group
adduser adminops
usermod -aG sudo adminopsadduser creates the home directory and prompts for an account password and optional metadata. The password can be locked later if your policy is public-key-only, but do not lock or remove every recovery method before the key-based session is proven. Membership in Ubuntu’s sudo group permits administrative elevation; if the person needs only a small set of commands, use a narrowly scoped sudoers rule instead of unrestricted group membership.
2. Install the administrator’s public key
Create the SSH directory with ownership and modes that OpenSSH accepts, then place the administrator’s public key in authorized_keys. Replace the example key line with the complete public key from the administrator’s workstation.
install -d -m 700 -o adminops -g adminops /home/adminops/.ssh
echo 'ssh-ed25519 AAAA...replace-with-the-real-public-key... workstation' > /home/adminops/.ssh/authorized_keys
chown adminops:adminops /home/adminops/.ssh/authorized_keys
chmod 600 /home/adminops/.ssh/authorized_keysThe key belongs to the named account, not to root. If you copy an existing key file, verify that the final owner is adminops, the directory is mode 700, and authorized_keys is mode 600. A password being locked does not remove a public key already present in authorized_keys; key access must be removed separately when an administrator leaves.
3. Test the new login in a second terminal
Open a new terminal without closing the original recovery channel. Connect as the new account using its private key:
ssh -i ~/.ssh/your-adminops-key adminops@your-vps-addressAfter login, verify both identity and elevation:
id -un
sudo -v
sudo id -uThe first command should print adminops, and the final command should print 0. Also test the exact administrative tasks you expect to perform, such as editing a protected configuration file or restarting a service. A successful SSH login that cannot use sudo is not a usable replacement for root.
4. Check the daemon’s effective settings before editing
OpenSSH can combine a main configuration file with included snippets. Review the active value rather than relying on a tutorial’s assumed default:
Recommended Free Tools
Rank #3
sshd -T | grep -i '^permitrootlogin 'On Ubuntu, the main file is commonly /etc/ssh/sshd_config, with optional files under /etc/ssh/sshd_config.d/. Ensure that the line you change is not later overridden by an included file. Keep a copy of the prior configuration so you can restore it from the provider console if necessary.
5. Validate the configuration without restarting SSH
sshd -tNo output and a successful exit status indicate that the daemon accepted the syntax. If the command reports an error, do not reload SSH. Fix the reported file and line from the still-open recovery session, then run the test again. Syntax validation does not prove that a user can authenticate, which is why the second-terminal test is a separate required step.
6. Reload SSH only after both tests succeed
systemctl reload sshA reload asks the running service to apply the validated configuration while preserving existing connections. Keep the original root or provider session open until you have established a fresh session as adminops after the reload and confirmed sudo works.
7. Disable root SSH access
Edit the active SSH server configuration and set:
PermitRootLogin noRun sshd -t again, reload the service, and test the named account from a new terminal. Do not test only by closing your original connection: an existing session can remain usable even when new root logins are blocked.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →How to avoid locking yourself out
The most common lockout is changing the daemon before another administrator can authenticate. The prevention is procedural:
Rank #4
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
- Leave the initial provider, serial, or root session open.
- Create the named account and install its public key.
- Connect from a separate terminal as that account.
- Run
sudo -vand one harmless privileged command to confirm elevation. - Validate the daemon with
sshd -t. - Reload SSH, not a stop-and-start sequence, while the recovery channel remains available.
- Establish another new session as the named account.
- Only then set
PermitRootLogin noand perform the final validation.
Keep the provider recovery console documented even after the change. It is the fallback for a bad firewall rule, an expired key, a damaged filesystem, or an SSH configuration that prevents every network login. A recovery console is not a substitute for testing the account; it is the channel that lets you repair a failed test.
Troubleshooting branches
The new account gets “Permission denied (publickey)”
- Confirm that the client is using the private key matching the public key in
/home/adminops/.ssh/authorized_keys. - Check the account, home-directory,
.ssh, andauthorized_keysownership and modes. - Make sure the key line was copied completely, with no wrapping or extra characters.
- Review the SSH server log from the provider console for the reason OpenSSH rejected the key.
The account logs in but sudo fails
- Confirm the account was added to Ubuntu’s
sudogroup and start a new login session so group membership is refreshed. - Run
sudo -vand read the exact policy error; a syntax-valid SSH configuration does not grant sudo rights. - If the account intentionally has limited privileges, verify that the requested command is included in its sudoers rule.
sshd -t reports an error
Do not reload. Use the line number and file named in the error, restore the last known-good version if needed, and test again from the open recovery session. Included configuration files can create an apparent conflict even when the line in the main file looks correct.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11You disabled root and now no network login works
Use the provider or serial recovery console, inspect the effective SSH configuration, and restore a known-good setting. Check the VPS firewall and security-group rules as well as SSH syntax. Once access is restored, repeat the account-key test in a separate terminal before attempting the hardening change again.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Password, keyboard-interactive, and public-key choices
PermitRootLogin no is the clearest policy when interactive root SSH is not needed: it rejects root authentication entirely. prohibit-password is narrower. It blocks root passwords and keyboard-interactive authentication but may still permit a root public key, so it should not be described as “root disabled.” If a root key remains authorized under that policy, possession of that key still provides root SSH access.
Public-key authentication should be installed on the named account before any password is locked. Locking an account password does not delete keys in authorized_keys, and deleting a key does not necessarily disable another authentication method enabled by the distribution. Decide separately whether the named account may use passwords, keyboard-interactive prompts, or multi-factor authentication; the correct combination depends on the distribution’s defaults and your threat model.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
For automation that must run as root, forced-commands-only can restrict a particular root public key to a forced command. This is suitable for a backup or deployment workflow that has no reason to open an interactive shell. Treat it as a constrained exception, not as a reason to keep routine administrator logins as root.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat changes for SCP, SFTP, and administrative files
When root SSH login is set to no, root-authenticated SCP and SFTP are blocked along with interactive SSH. Transfer files using the named account, then use sudo for the installation step. For example, upload a file to the administrator’s home directory, inspect it, and move it into a protected location with an explicit sudo command. This preserves an audit trail and avoids granting a file-transfer client an unrestricted root session.
Scripts that currently call ssh root@host, scp root@host, or sftp root@host must be changed before the policy is enforced. Use a dedicated named service account where possible, give it the minimum sudo rule required for the operation, and use a forced command when the workflow can be reduced to one fixed action. Test automation in a staging or maintenance window; a human login test does not prove that a non-interactive job has the right environment or sudo behavior.
Distribution and image differences you must account for
Ubuntu
Ubuntu documents that the administrative root account is disabled by default. Its guidance uses a normal user, membership in the appropriate administrative group, an authorized public key, and PermitRootLogin no as part of a secure SSH setup. An Ubuntu cloud image may still have provider-specific users, keys, or drop-in files, so inspect the actual image rather than assuming a blank installation.
Debian
Debian’s current manual documents prohibit-password as the default for PermitRootLogin. That means a Debian host may still allow root public-key authentication even though root passwords are refused. If your objective is to eliminate root SSH, set PermitRootLogin no explicitly after the named account is ready.
RHEL-derived systems and provider recovery environments
Red Hat’s security guidance instructs administrators to edit /etc/ssh/sshd_config and change the root-login setting to PermitRootLogin no. Group names, service-management commands, cloud-init behavior, and recovery-console details can differ from Ubuntu. Follow the target release’s supported syntax and keep the provider’s out-of-band console available.
A practical policy for daily administration
- Give every human administrator an individual account and key.
- Use a separate key for automation instead of reusing a personal key.
- Grant unrestricted sudo only where it is genuinely required; otherwise define a limited command set.
- Keep root SSH disabled for interactive work with
PermitRootLogin no. - Review and remove departed users’ keys from their own
authorized_keysfiles. - Retain and periodically test the provider recovery path.
- Document which scripts, backup jobs, and file-transfer processes depend on root authentication before enforcing the change.
This policy preserves emergency administration: an authenticated named administrator can still run sudo and obtain root-level capabilities. It changes the exposed entry point and makes the deliberate elevation visible instead of removing the ability to repair the server.
Quick Recap
Final verification checklist
- A second terminal can log in with the named account’s private key.
id -unidentifies the named account, not root.sudo -vsucceeds, and a permitted privileged command works.- The public key is in the named account’s
authorized_keyswith correct ownership and modes. sshd -tsucceeds before every reload.- The effective configuration reports
PermitRootLogin no. - A fresh named-account session works after the reload.
- The provider or serial recovery console remains documented and usable.
- Automation has been migrated away from direct root SSH or constrained with an intentional forced-command policy.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
