How to Completely Disable the ‘root’ Login Over SSH to Protect Your Linux Server

When you lease a brand new Linux server from a cloud hosting provider, the default configuration often allows you to connect to the machine via SSH using the root account. The root account has absolute, unchecked, god-like power over the entire operating system. It can delete the kernel, format the hard drive, and wipe every log file without any restrictions.

Because the username “root” exists on literally every single Linux machine on the planet, hackers do not have to guess the username. They only have to guess the password. The second your server connects to the public internet, automated botnets will begin slamming your SSH port, firing thousands of dictionary password guesses a minute at the root account.

To secure your infrastructure, you must permanently ban the root account from logging in over the network. You will still be able to become root locally (using the sudo command), but external hackers will be completely locked out.

Step 1: Create a Standard User Account

If you disable root login right now while you are logged in as root, you will permanently lock yourself out of the server when you disconnect. You must create a standard, unprivileged “doorway” account first.

1. Log into your server as root.
2. Create a new user (replace ‘john’ with your actual name):

   adduser john

3. Set a strong password for this new account.
4. Add the new user to the sudo group so they have the ability to run administrative commands once they are safely inside:

   usermod -aG sudo john

Step 2: Modify the SSH Daemon Configuration

Now that you have a safe doorway, you can permanently brick up the root entrance.

1. Open the core configuration file for the SSH service using nano:

   sudo nano /etc/ssh/sshd_config

2. Use the arrow keys to scroll down through the file until you find a line that looks like this:

   PermitRootLogin yes

   (Note: On some systems, it might say PermitRootLogin prohibit-password or it might be commented out with a #).
3. Delete whatever is currently there, and type this exactly:

   PermitRootLogin no

4. Save the file by pressing Ctrl+O, then Enter. Exit by pressing Ctrl+X.

Step 3: Restart the SSH Service

The SSH daemon needs to be restarted for it to read the new configuration file and lock the door.

1. Run the following command:

   sudo systemctl restart sshd

Do not close your current terminal window yet.

Step 4: Verify the Lockout

Open a brand new, secondary Terminal window on your local computer.

1. Attempt to log into your server as root: ssh root@your_server_ip

The server will instantly reject the connection with a “Permission denied” error, even if you type the correct root password. The network door is permanently welded shut.

To manage your server, you must now log in using your standard account (ssh john@your_server_ip). Once you are safely inside the machine, you simply type sudo -i, enter your password, and you are instantly granted root privileges, maintaining total control of your machine while rendering automated botnets completely powerless.