iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Disable direct root SSH access only after a separate, tested administrator account can log in and use sudo. Keep the current root or console session open, set the effective OpenSSH directive to PermitRootLogin no, validate the parsed configuration, reload the daemon with your distribution’s supported service tooling, and test a new administrator connection before ending the old session. This blocks root authentication over SSH; it does not disable root access through a provider console or local recovery environment.
What disabling root SSH login actually does
PermitRootLogin controls whether the root account may authenticate through the OpenSSH server. Setting it to no rejects root SSH login regardless of whether the attempted method is a password, keyboard-interactive authentication, or a public key. You then administer the VPS through an individual account and elevate specific commands with sudo.
Free tools Windows power users keep installed
One-click scans. No signup required.
This is an SSH policy change, not a deletion or lockout of the root account. Root can still exist for local administration, emergency console work, maintenance tasks, and recovery procedures. A provider’s web console, serial console, rescue system, or another out-of-band route is separate from SSH and may continue to offer root access according to the provider and operating system configuration.
Using named administrator accounts also gives your team a clearer audit trail than sharing one root login. The security benefit depends on the replacement account being protected and on sudo being configured appropriately; changing one SSH directive does not replace key management, patching, logging, or least-privilege controls.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Before you change anything
Confirm a replacement administrator exists
Create or identify an individual account intended for routine administration. It must have a working SSH key or another authentication method approved for the VPS, and it must be able to run sudo. Red Hat’s hardening guidance recommends authenticating with an individual account and escalating privileges instead of logging in directly as root.
Do not treat an account as ready merely because it appears in /etc/passwd or has been granted membership in an administrator group. Open a separate SSH connection as that user and perform a real privileged operation that your change process allows. Confirm that authentication succeeds without relying on the already-open root session and that sudo asks for, accepts, or does not require credentials exactly as your policy intends.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors- The account has the correct username and host address.
- The private key is available in the terminal or automation system that will be used after the change.
- The corresponding public key is installed for that account on the VPS.
- The account can obtain the required administrative privileges with
sudo. - You know how to revoke or replace the account’s key if it is lost.
Keep an independent recovery route
Leave the current root SSH session open while editing and testing. Before reloading the daemon, verify that the VPS provider’s console or another out-of-band route is available and that you know how to use it. A syntax error, an incorrect file edit, a failed reload, or a mistaken account permission can otherwise require provider-assisted recovery.
Use the existing root session as a safety line, not as proof that the new configuration works. An already-established SSH session can remain active after a policy change even though new sessions would be rejected, so it cannot validate future access by itself.
Identify the distribution and service tooling
Ubuntu, Debian, Red Hat-derived systems, and VPS images assembled by cloud providers can differ in service names, drop-in locations, cloud-init behavior, and console features. Record the distribution and version, then use that distribution’s documented command for validating and reloading OpenSSH. Do not assume that a command or service name from another image is correct for the target VPS.
Understand the four root-login policies
The value matters more than the presence of a line in one particular file. OpenSSH may read the main configuration and enabled drop-ins, so evaluate the effective result that the daemon parses.
| Setting | Can root authenticate through SSH? | Can a root public key still work? | Root password and keyboard-interactive methods | Meaning for routine administration |
|---|---|---|---|---|
yes |
Yes | Yes | May remain available according to other authentication settings | Direct root SSH administration is allowed. |
prohibit-password |
Yes, with permitted non-password methods | Yes | Disabled for root | Not a complete root-login ban; key-based root access remains possible. |
forced-commands-only |
Only in a restricted key scenario | Only keys carrying a forced command | Not available as a normal root password login | Useful for narrowly controlled automation, not ordinary interactive administration. |
no |
No | No | No root SSH authentication | Direct root login over SSH is disabled. |
Ubuntu and Debian’s OpenSSH documentation state that when this option is set to no, root is not allowed to log in. The important distinction is between “no root login” and “no root password”: prohibit-password removes password and keyboard-interactive authentication but still permits public-key root login.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Step-by-step: disable root SSH login without losing access
1. Open a controlled maintenance session
Start with the existing root SSH connection or an approved console session. Avoid making the change during a network interruption, provider maintenance window, or period when you cannot open a second terminal. Keep this first session untouched until the replacement login and root rejection tests have both succeeded.
If several administrators share responsibility, tell them that the SSH policy is changing and identify the account that will replace direct root access. This prevents another operator from closing the only known working session while testing is still incomplete.
2. Test the replacement account from a separate terminal
From a different terminal, connect to the VPS using the individual administrator account and its approved authentication method. A successful connection must be a new SSH session, not a shell opened from the root session with a local user-switching command.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Once connected, verify that the account can perform the administrative action needed for the maintenance workflow through sudo. If the account cannot authenticate, has no usable key, or cannot elevate privileges, stop here. Fix the account first; do not disable root SSH access as a way to force the new workflow into existence.
3. Inspect every configuration file OpenSSH actually reads
The conventional main server configuration is /etc/ssh/sshd_config. The effective policy may also be supplied by an enabled distribution drop-in. Inspect the main file and the drop-in configuration used by the target distribution, looking for existing PermitRootLogin entries and for later package or image-specific settings that could affect the result.
Do not assume that adding a second line to the bottom of the main file automatically determines the policy. The daemon’s parsed configuration is authoritative. Record which file supplies the effective directive so that a future package update or cloud-init run does not silently restore a different value.
4. Set the directive to no
In the configuration location that should supply the effective value, add or change the directive to exactly:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
PermitRootLogin noRemove or correct conflicting entries according to your distribution’s configuration conventions rather than leaving several contradictory lines for a future administrator to interpret. Preserve a backup or use your normal configuration-management change process so the edit can be reviewed and reverted if necessary.
Do not substitute prohibit-password if your requirement is to prevent all root SSH authentication. That setting still allows a root public key, which means a key-based root connection can continue to work even though a root password login fails.
5. Validate syntax before reloading
Use the syntax checker and effective-configuration checks supported by the VPS distribution before asking the running daemon to adopt the edit. The CIS benchmark demonstrates checking the parsed value with sshd -T and inspecting the configuration for conflicting PermitRootLogin entries.
Run the effective check with the privileges required by your system and confirm that the output reports:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11permitrootlogin noThe exact capitalization of the displayed option is not important; the value is. If the check reports yes, prohibit-password, or no value because the command failed, do not reload. Re-open the main file and enabled drop-ins, find the directive that wins in the parsed configuration, and correct that source.
A syntax check that returns an error is a hard stop. Read the reported file and line, repair the malformed setting, and run the validation again. Never use a reload as a test for whether a configuration is syntactically valid.
6. Reload the SSH daemon using the distribution’s supported method
After validation succeeds, reload—not an unplanned stop—the SSH service with the service tooling documented for the target distribution and VPS image. Service names and management commands vary, so use the name and procedure supplied by that operating system. A successful reload applies the new policy to future authentication attempts while normally leaving established sessions running.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Watch the service result for an error. If the reload fails, leave the original root session open, restore the last known-good configuration if necessary, and resolve the reported problem before attempting another reload. Do not close the safety session merely because the command returned to a shell.
7. Test a new administrator connection
Open another separate terminal and connect again as the replacement administrator. This confirms that the reload did not break ordinary SSH access and that the account’s authentication method still works under the running daemon. Use the account to verify the administrative path through sudo once more.
Keep the original root session open while this test runs. The sequence matters: first establish a working replacement session, then test the policy that should reject root, and only afterward consider closing the old session.
8. Confirm that a new root SSH attempt is rejected
From a separate terminal, deliberately attempt a new SSH connection as root using the method your policy is intended to block. The connection should be rejected by the SSH server. A failed root attempt is expected after PermitRootLogin no; it is not evidence that the entire VPS is inaccessible.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Interpret the result carefully. If a root key still succeeds, the running daemon is not using the policy you intended, the reload did not apply, a different SSH endpoint is being tested, or another configuration path is supplying a different effective value. Return to the effective sshd -T output and the service status rather than guessing.
9. Close the old session only after both tests pass
Once the replacement administrator can connect and a new root attempt is rejected, you may close the original root SSH session. Keep the provider console or other recovery method available for future maintenance. If you operate the VPS through automation, update the automation to use the individual administrator account and its approved privilege-escalation path before removing any stored root credentials.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the effective configuration matters
Editing only /etc/ssh/sshd_config can produce a false sense of security when the distribution enables additional configuration files. A drop-in may contain its own PermitRootLogin directive, and cloud-init or package updates can alter those files later. The value displayed by the daemon’s effective-configuration query is the policy currently in force, not the value you remember typing.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
For a durable change, document the file that supplied the winning directive, the validation output, the reload result, and the date. Recheck after major package updates, image rebuilds, or cloud-init changes. If configuration management owns the SSH files, make the policy change there as well; otherwise an automated reconciliation may undo it.
Troubleshooting common failure paths
The replacement account cannot log in
Do not proceed with disabling root access. Check the username, destination address, key selection, and server-side key installation for that account. Confirm that the account is permitted to use SSH and that its approved authentication method is available from a second terminal. If authentication works but administrative commands fail, correct the account’s sudo authorization and test again.
sshd -T still reports yes or prohibit-password
The directive you edited is not the effective one. Search the main configuration and enabled drop-ins for every PermitRootLogin entry, then follow the distribution’s documented ordering and inclusion rules. Correct the file that actually supplies the parsed value, validate again, and reload only after the effective output says no.
The syntax check fails
Leave the existing session open and read the error exactly as reported. Restore the last known-good version if you cannot identify the malformed line, then validate that restored file before making a smaller, reviewed edit. A failed syntax check means the running daemon should not be asked to adopt the configuration.
The reload fails or the service will not remain active
Use the distribution’s service status and log tools to identify whether the error is a syntax problem, an unavailable include file, a permission issue, or another daemon failure. Keep the recovery route available. Restore the known-good configuration when necessary, validate it, and only then attempt the change again.
Recommended Free Tools
Root can still connect after the change
First verify that you are testing the same VPS and SSH endpoint, not a different address, bastion, container, or provider console. Then inspect the running daemon’s effective value with sshd -T and confirm that the reload succeeded. If the effective value is not no, find the active configuration source. If it is no yet root still connects, investigate whether the connection is using an already-established session or a different SSH service.
You closed the only working SSH session
Use the provider console, serial console, rescue environment, or other out-of-band route prepared before the change. From there, restore a known-good SSH configuration, validate it, and re-establish a tested administrator account. If no recovery route exists, contact the VPS provider rather than repeatedly attempting remote changes that cannot be observed.
Post-change checklist and record
- Replacement administrator tested from a fresh SSH connection.
- Replacement account confirmed to have the required
sudoaccess. - Current root or console session retained during editing and testing.
- Recovery console or another out-of-band path verified.
- Main configuration and enabled drop-ins inspected.
- Effective value confirmed as
permitrootlogin nowith the supported check. - SSH daemon reloaded through the target distribution’s documented service tooling.
- Fresh administrator connection tested after the reload.
- Fresh root SSH attempt rejected.
- Distribution, version, configuration source, validation output, reload result, and change date recorded.
- Automation and operational documentation updated to use the individual administrator account.
Retain this record with the VPS change history. It tells the next administrator which file controls the policy and how the result was verified, instead of relying on an assumption that a familiar line in the main file is still authoritative.
Scope and limitations
This procedure applies to OpenSSH servers on Linux VPS distributions represented by Ubuntu, Debian, and Red Hat documentation. Exact service commands, drop-in paths, cloud-init behavior, and provider recovery features vary by distribution and image. Verify those details for the specific VPS before execution. The directive blocks root authentication through the OpenSSH server; it does not govern local console login, rescue systems, other remote-management agents, or an already-established SSH session.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
