How to Disable Root Login on Linux

Direct root login is the account every attacker tries first, and it leaves no record of who did what. The fix is to log in as a normal user and elevate with sudo. Before you disable root, make sure you have a working sudo-capable account, or you will lock yourself out.

Step 0: confirm you have a way back in

# As your normal user, prove sudo works BEFORE disabling root:
sudo whoami        # should print: root

If that prints root, you are safe to proceed. If it does not, grant sudo first and re-test.

Disable root login over SSH

This is the one that matters most, because SSH is the internet-facing door. In /etc/ssh/sshd_config (or a drop-in under /etc/ssh/sshd_config.d/):

PermitRootLogin no

Check and reload without dropping your session:

sudo sshd -t                       # validate config
sudo systemctl reload ssh          # or: reload sshd

Keep your current session open and confirm a fresh ssh youruser@server still works before closing it. PermitRootLogin prohibit-password is a middle ground: it blocks root password logins but still allows a root SSH key (useful for some automation); no blocks root entirely.

Lock the root password (console too)

Disabling SSH root login does not touch console or su access. To stop anyone from su - into root with a password, lock the root password:

sudo passwd -l root

This puts a ! in the hash so no password matches. You still become root through sudo (which does not use the root password), so nothing you rely on breaks. To check: sudo passwd -S root shows L.

What you do NOT want

Do not delete the root account or set its shell to nologin blindly: many system tools and recovery paths expect root to exist. Locking the password and disabling SSH root login achieves the security goal while keeping the account intact for sudo and single-user recovery.

FAQ

See also

• How to give a user sudo access: set up the account that replaces root login. Do this first.
• Harden sshd: disable password authentication: the other half of locking down SSH.
• Lock and unlock a user account: the passwd -l mechanics.
• Run a command as another user (sudo -u): elevate deliberately instead of living as root.
• encrypt the disk with LUKS: protect the data at rest, not just the login.
• block rogue USB with USBGuard: another physical-access defense.