Disable root login over SSH

The fix/etc/ssh/sshd_config

PermitRootLogin no

Then reload the daemon. The service name differs by distribution:

sudo systemctl reload ssh     # Debian, Ubuntu
sudo systemctl reload sshd    # RHEL, Rocky, Alma, Fedora

Why it matters

Root exists on every Linux host and its name never has to be guessed, so it absorbs the large majority of automated SSH brute-force traffic. Every other account requires an attacker to learn a username first; root gives them half the credential for free.

Denying root login removes the target rather than defending it. An attacker who compromises a normal user’s key still has to escalate, which is a second obstacle and — because sudo is logged — a much louder one.

The options, precisely

PermitRootLogin takes four values, and the difference between two of them catches people out:

Value	Effect
no	Root cannot log in over SSH by any method.
prohibit-password	Root may log in with a key, but not a password.
forced-commands-only	Root may log in with a key, and only to run a command specified in authorized_keys.
yes	Root may log in with a password.

Use no. Reach for prohibit-password only if automation genuinely needs to authenticate as root — and prefer giving that automation its own account with scoped sudo instead.

Verify it worked

Check the running daemon, not the file. sshd -T prints the effective configuration after all drop-ins and Match blocks are resolved:

sudo sshd -T | grep -i permitrootlogin

Expect exactly:

permitrootlogin no

If it still reports yes or prohibit-password after you edited the main config, a drop-in file in /etc/ssh/sshd_config.d/ is overriding you — the first matching directive wins, not the last.

Before you apply this

Confirm you have another way in before you reload. You need a non-root user that can log in over SSH and escalate with sudo. Check both from a second terminal while your current session stays open:

ssh youruser@host
sudo -v

If root is your only access path, this directive locks you out of the host, and recovery needs console or provider-level access. On a cloud instance that means the serial console or a rescue boot — not another SSH attempt.

Related

• Require key-only authentication — apply this first; it’s what makes losing root login safe.