PermitRootLogin no to a file such as /etc/ssh/sshd_config.d/00-no-root.conf, check it with sudo sshd -t, and restart SSH with sudo systemctl restart ssh (Ubuntu/Debian) or sudo systemctl restart sshd (AlmaLinux/Rocky). Root can still log in on the console.
Automated attacks almost always try the user name
root, because it exists on every Linux server. With root login disabled, an attacker must also guess a user name, and you log in as yourself and use sudo only when needed.
Before you start
- Create a personal user with sudo rights. See create a sudo user.
- Log in as that user and run
sudo whoami. The answer must beroot. - Keep your current session open until you have tested the change.
- If you lock yourself out, the VNC console still accepts root, because this setting only affects SSH. On a dedicated server, open a ticket if you need console access.
Which PermitRootLogin value should I use?
Values come from the sshd_config manual.
How to disable root login over SSH
1
Check the current setting
sshd -T prints the settings SSH really uses after reading every file. without-password is the older name of prohibit-password.2
Create a drop-in file
/etc/ssh/sshd_config.d/ are read before the rest of /etc/ssh/sshd_config, and in name order, so the number 00- wins over files such as 01-permitrootlogin.conf (AlmaLinux/Rocky installer) or 50-cloud-init.conf.3
Test the configuration
4
Restart SSH
- Ubuntu / Debian
- AlmaLinux / Rocky
How to check it worked
Confirm the setting SSH now uses:Permission denied, even with the right password or key. Then log in as your sudo user to confirm it still works.
How to log in as root after disabling SSH root login
Log in as your own user and switch to root when needed:exit to return to your own user. File transfer tools such as WinSCP and FileZilla should also use your own user; see transfer files with SFTP.
How to allow only certain users to log in over SSH
For a stricter setup, add an allow-list to the same drop-in file. Only the listed users can log in:AllowUsers alex deploy. Test with sudo sshd -t and restart SSH as above.
Frequently asked questions
Does disabling root login affect the VNC console?
No.PermitRootLogin only controls SSH. You can still log in as root on the VNC console.
I set PermitRootLogin no but root can still log in. Why?
Another file sets it first. Runsudo grep -ri permitrootlogin /etc/ssh/ to find every line. Give your drop-in file a lower number, or remove the other line, then restart SSH.
Should I also lock the root password?
It is optional.sudo passwd -l root locks the password, but then you cannot log in as root on the console either, and some recovery steps need it. Most servers only need SSH root login disabled.
Is disabling password login better than disabling root login?
They solve different problems, so do both. See disable password login for SSH.Related guides
VPS and dedicated server guides
Every guide in this section.
Create a sudo user
Do this first.
Disable password login
Allow SSH keys only.
SSH two-factor login
Add a one-time code.
Fix SSH permission denied
When a key login fails.
Security checklist
Harden the rest of your server.
Checked against the official sshd_config manual on 4 November 2026; the drop-in file was tested with
sshd -t and sshd -T on Ubuntu 24.04 LTS (OpenSSH 9.6). Commands can differ on other distributions or releases.Need Extra Help?
If you encounter any issues, our support team is ready to assist:- Live Chat: Quick assistance via our website.
- Support Ticket: Open a Ticket
- Discord: Join our Community
- Email: support@freakhosting.com
Last Updated: November 2026