Disable root login and password authentication over SSH

Bots try to guess root passwords on every public server, all day. Once you log in with a key as a normal sudo user, you can switch off both root logins and password logins, and those attempts become harmless.

Before you start

You need all of these, or you risk locking yourself out:

• A normal user with sudo rights. See Create a sudo user on Linux.
• An SSH key that already works for that user. See Set up SSH keys.
• A terminal that is already logged in and stays open until you finish testing.

1. Check where the current settings come from

Ubuntu 22.04 and 24.04, Debian 12 and AlmaLinux/Rocky 9 read extra files from /etc/ssh/sshd_config.d/ before the main file, and the first value found wins. Some images ship a file there that turns passwords on. See what is set:

sudo grep -rEi 'permitrootlogin|passwordauthentication' /etc/ssh/sshd_config /etc/ssh/sshd_config.d/

2. Add a drop-in file

Files are read in alphabetical order, so a name starting with 01- takes priority over files such as 50-cloud-init.conf:

sudo nano /etc/ssh/sshd_config.d/01-hardening.conf

Add these lines and save:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

If you still need root for automated tools that log in with a key, use PermitRootLogin prohibit-password instead of no.

3. Check the configuration, then reload

sshd -t prints nothing when the file is valid. sshd -T shows the settings SSH will actually use:

sudo sshd -t
sudo sshd -T | grep -Ei 'permitrootlogin|passwordauthentication|kbdinteractive'

Reload the service. It is called ssh on Ubuntu and Debian, and sshd on AlmaLinux and Rocky Linux:

sudo systemctl reload ssh     # Ubuntu / Debian
sudo systemctl reload sshd    # AlmaLinux / Rocky Linux

Reloading does not drop your current session.

4. Test from a second terminal

ssh alex@203.0.113.25
ssh root@203.0.113.25

The first should log in with your key. The second should fail with Permission denied. To prove passwords are off, try ssh -o PubkeyAuthentication=no alex@203.0.113.25: it should be refused without asking for a password.

Troubleshooting

• Root can still log in: another file sets the value first. Re-run the grep from step 1 and make sure your file sorts before it.
• sshd -t reports an error: fix the line it names before reloading. A reload with a broken file keeps the old settings, but a later restart or reboot would fail.
• Locked out: log in through the browser console (Open Control Panel on your service page), remove /etc/ssh/sshd_config.d/01-hardening.conf and reload SSH.

Next steps

• Protect SSH with Fail2ban
• Change the SSH port safely