Disabling SSH logins for the root account

For security reasons, one of the first steps you should take when setting up a new VPS or dedicated server is to disable SSH logins for the root account. Allowing direct root logins can expose your server to brute-force attacks. Instead, you should create a normal user account with administrative privileges and use that account for SSH access.

Note

• These steps apply only to VPS or dedicated servers with root access.
• Shared hosting accounts do not have root access.
• Always create and test a new user account before disabling root SSH logins.

Step 1: Create a Normal User Account

Before disabling root logins, you must create a new user with administrative privileges.

On AlmaLinux / Fedora

1. Log in to your server as root via SSH.

2. Create a new user:

   useradd username
   passwd username

3. Grant administrative privileges:

   visudo

   Add this line:

   username ALL=(ALL) ALL

On Debian / Ubuntu

1. Log in to your server as root via SSH.

2. Create a new user:

   adduser username

3. Install sudo if not already installed:

   apt-get install sudo

4. Add the user to the sudo group:

   usermod -a -G sudo username

Now, the new user can run administrative commands by prefixing them with sudo.

Step 2: Disable Root SSH Logins

Once your new user is created and tested, disable root SSH access:

1. Log in as root.

2. Open the SSH configuration file:

   nano /etc/ssh/sshd_config

3. Locate the line:

   PermitRootLogin yes

   Change it to:

   PermitRootLogin no

4. (Optional but recommended) Add your new user to the allowed list:

   AllowUsers username

   If you skip this step, you may lock yourself out of the server.

5. Save and exit the file.

6. Restart the SSH service:

   • On AlmaLinux/Fedora:

     service sshd restart

   • On Debian/Ubuntu:

     service ssh restart

7. Open a new terminal window and test logging in with your new user.

   • Do not close your root session until you confirm the new user can log in successfully.