# Disabling SSH logins for the root account

> Stop direct root logins over SSH on your VPS or dedicated server and use an administrative user instead.

Source: https://helpcenter.ruachost.com/getting-started/your-account/disabling-ssh-logins-for-the-root-account-in-ruachost/

For security reasons, one of the first steps you should take when setting up a new VPS or dedicated server is to **disable SSH logins for the root account**. Allowing direct root logins can expose your server to brute-force attacks. Instead, you should create a normal user account with administrative privileges and use that account for SSH access.

> **Note:**
- These steps apply only to VPS or dedicated servers with **root access**.
- Shared hosting accounts do not have root access.
- Always create and test a new user account before disabling root SSH logins.

## Step 1: Create a Normal User Account

Before disabling root logins, you must create a new user with administrative privileges.

### On AlmaLinux / Fedora

1. Log in to your server as **root** via SSH.
2. Create a new user:

   ```
   useradd username
   passwd username
   ```
3. Grant administrative privileges:

   ```
   visudo
   ```

   Add this line:

   ```
   username ALL=(ALL) ALL
   ```

### On Debian / Ubuntu

1. Log in to your server as **root** via SSH.
2. Create a new user:

   ```
   adduser username
   ```
3. Install `sudo` if not already installed:

   ```
   apt-get install sudo
   ```

   ```
   ```
4. Add the user to the sudo group:

   ```
   usermod -a -G sudo username
   ```

Now, the new user can run administrative commands by prefixing them with `sudo`.

## Step 2: Disable Root SSH Logins

Once your new user is created and tested, disable root SSH access:

1. Log in as **root**.
2. Open the SSH configuration file:

   ```
   nano /etc/ssh/sshd_config
   ```
3. Locate the line:

   ```
   PermitRootLogin yes
   ```

   Change it to:

   ```
   PermitRootLogin no
   ```
4. (Optional but recommended) Add your new user to the allowed list:

   ```
   AllowUsers username
   ```

    If you skip this step, you may lock yourself out of the server.
5. Save and exit the file.
6. Restart the SSH service:

   - On AlmaLinux/Fedora:

     ```
     service sshd restart
     ```
   - On Debian/Ubuntu:

     ```
     service ssh restart
     ```
7. Open a **new terminal window** and test logging in with your new user.

   - Do not close your root session until you confirm the new user can log in successfully.