> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Disable Root Login over SSH on Linux

> Disable root login over SSH: create a sudo user, set PermitRootLogin no in /etc/ssh/sshd_config.d/, test with sudo sshd -t and restart the SSH service.

To disable root login over SSH, first create a sudo user and confirm you can log in with it. Then add `PermitRootLogin no` to a file such as `/etc/ssh/sshd_config.d/00-no-root.conf`, check it with `sudo sshd -t`, and restart SSH with `sudo systemctl restart ssh` (Ubuntu/Debian) or `sudo systemctl restart sshd` (AlmaLinux/Rocky). Root can still log in on the console.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 5 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | A working sudo user |

Automated attacks almost always try the user name `root`, because it exists on every Linux server. With root login disabled, an attacker must also guess a user name, and you log in as yourself and use `sudo` only when needed.

## Before you start

* Create a personal user with sudo rights. See [create a sudo user](https://help.freakhosting.com/portals/other/how-to-create-a-sudo-user-on-linux.md).
* Log in as that user and run `sudo whoami`. The answer must be `root`.
* Keep your current session open until you have tested the change.
* If you lock yourself out, the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) still accepts root, because this setting only affects SSH. On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) if you need console access.

> [!WARNING]
>
> Do not disable root login until your sudo user can log in over SSH and run `sudo`. Otherwise no account can manage the server over SSH.

## Which PermitRootLogin value should I use?

| Value | Effect |
| - | - |
| `no` | Root cannot log in over SSH at all. Recommended. |
| `prohibit-password` | Root can log in with an SSH key, not a password. This is the OpenSSH default. |
| `forced-commands-only` | Root can log in with a key only to run the command set for that key (for example a backup script). |
| `yes` | Root can log in with a password or key. Avoid. |

Values come from the [sshd\_config manual](https://manpages.ubuntu.com/manpages/noble/man5/sshd_config.5.html).

## How to disable root login over SSH

**1. Check the current setting**

```bash theme={null}
sudo sshd -T | grep -i permitrootlogin
```

`sshd -T` prints the settings SSH really uses after reading every file. `without-password` is the older name of `prohibit-password`.

**2. Create a drop-in file**

```bash theme={null}
sudo nano /etc/ssh/sshd_config.d/00-no-root.conf
```

Add this line:

```ini theme={null}
PermitRootLogin no
```

For each setting, SSH uses the first value it reads. Files in `/etc/ssh/sshd_config.d/` are read before the rest of `/etc/ssh/sshd_config`, and in name order, so the number `00-` wins over files such as `01-permitrootlogin.conf` (AlmaLinux/Rocky installer) or `50-cloud-init.conf`.

**3. Test the configuration**

```bash theme={null}
sudo sshd -t
```

No output means the syntax is valid.

**4. Restart SSH**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo systemctl restart ssh
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo systemctl restart sshd
> ```

Your open session stays connected.

## How to check it worked

Confirm the setting SSH now uses:

```bash theme={null}
sudo sshd -T | grep -i permitrootlogin
```

```text theme={null}
permitrootlogin no
```

From a second terminal, try to log in as root:

```bash theme={null}
ssh root@203.0.113.10
```

The login fails with `Permission denied`, even with the right password or key. Then log in as your sudo user to confirm it still works.

## How to log in as root after disabling SSH root login

Log in as your own user and switch to root when needed:

```bash theme={null}
sudo -i
```

Type `exit` to return to your own user. File transfer tools such as WinSCP and FileZilla should also use your own user; see [transfer files with SFTP](https://help.freakhosting.com/portals/other/how-to-transfer-files-with-sftp-winscp-and-filezilla.md).

## How to allow only certain users to log in over SSH

For a stricter setup, add an allow-list to the same drop-in file. Only the listed users can log in:

```ini theme={null}
PermitRootLogin no
AllowUsers alex
```

Separate several names with spaces, for example `AllowUsers alex deploy`. Test with `sudo sshd -t` and restart SSH as above.

## Frequently asked questions

### Does disabling root login affect the VNC console?

No. `PermitRootLogin` only controls SSH. You can still log in as root on the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md).

### I set PermitRootLogin no but root can still log in. Why?

Another file sets it first. Run `sudo grep -ri permitrootlogin /etc/ssh/` to find every line. Give your drop-in file a lower number, or remove the other line, then restart SSH.

### Should I also lock the root password?

It is optional. `sudo passwd -l root` locks the password, but then you cannot log in as root on the console either, and some recovery steps need it. Most servers only need SSH root login disabled.

### Is disabling password login better than disabling root login?

They solve different problems, so do both. See [disable password login for SSH](https://help.freakhosting.com/portals/other/how-to-disable-password-login-for-ssh.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [Create a sudo user](https://help.freakhosting.com/portals/other/how-to-create-a-sudo-user-on-linux.md)
>
> Do this first.

> [card] [Disable password login](https://help.freakhosting.com/portals/other/how-to-disable-password-login-for-ssh.md)
>
> Allow SSH keys only.

> [card] [SSH two-factor login](https://help.freakhosting.com/portals/other/how-to-set-up-two-factor-authentication-for-ssh.md)
>
> Add a one-time code.

> [card] [Fix SSH permission denied](https://help.freakhosting.com/portals/other/how-to-fix-ssh-permission-denied-publickey.md)
>
> When a key login fails.

> [card] [Security checklist](https://help.freakhosting.com/portals/other/linux-server-security-checklist.md)
>
> Harden the rest of your server.

***

> [!NOTE]
>
> **Checked against the official [sshd\_config manual](https://manpages.ubuntu.com/manpages/noble/man5/sshd_config.5.html)** on 4 November 2026; the drop-in file was tested with `sshd -t` and `sshd -T` on Ubuntu 24.04 LTS (OpenSSH 9.6). Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.