Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For security purposes my company wants me to not allow anyone to be able to log into our Ubuntu server as root remotely over SSH. We still want the root account to exist, we just do not want it to be able to be logged into remotely. How would I accomplish this?

Thank you very much in advance for your time.

share|improve this question
up vote 49 down vote accepted

I assume you meant logging in over SSH? Put the following line to /etc/ssh/sshd_config:

PermitRootLogin no

If you want to deny certain users from logging in, put this in the configuration file:

DenyUsers root

This takes the blacklisting approach. Whitelisting is generally preferable. If your company needs to allow the rob and admin users log in on the server, use the following configuration directive:

AllowUsers rob admin

After making configuration file changes, restart the ssh service using the command:

sudo service ssh restart

See also the manual page.

share|improve this answer
10  
and sudo service ssh restart to take effect – Maxim Yefremov May 8 '14 at 19:06

Edit the file /etc/ssh/sshd_config, look for

PermitRootLogin

and set it to no.

share|improve this answer

The default configuration is for the root account to be locked so you can not log in as root remotely. You don't have to do anything else, unless you also want to make sure that you can not log in as root remotely by using an RSA key. Of course, if you don't want to do that, then just don't set up a root key.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.