For security purposes my company wants me to not allow anyone to be able to log into our Ubuntu server as root remotely over SSH. We still want the root account to exist, we just do not want it to be able to be logged into remotely. How would I accomplish this?

Thank you very much in advance for your time.

up vote 76 down vote accepted

I assume you meant logging in over SSH? Put the following line to /etc/ssh/sshd_config:

PermitRootLogin no

If you want to deny certain users from logging in, put this in the configuration file:

DenyUsers root

This takes the blacklisting approach. Whitelisting is generally preferable. If your company needs to allow the rob and admin users log in on the server, use the following configuration directive:

AllowUsers rob admin

After making configuration file changes, restart the ssh service using the command:

sudo service ssh restart

See also the manual page.

  • 11
    and sudo service ssh restart to take effect – Maxim Yefremov May 8 '14 at 19:06
  • I don't see sshd_config file , I see this one /etc/ssh/ssh_config. – Chinmaya B Sep 18 '16 at 19:29
  • @ChinmayaB You have probably not installed the OpenSSH server. Try sudo apt-get install openssh-server – Lekensteyn Sep 18 '16 at 19:51

Edit the file /etc/ssh/sshd_config, look for

PermitRootLogin

and set it to no.

  • If you do this without adding any users with AllowUsers <username> wouldn't this in effect allow no one to SSH in? – JGlass Jul 15 at 18:56

The default configuration is for the root account to be locked so you can not log in as root remotely. You don't have to do anything else, unless you also want to make sure that you can not log in as root remotely by using an RSA key. Of course, if you don't want to do that, then just don't set up a root key.

  • That was not the default for my Linode Ubuntu 14.04 machine. PermitRootLogin was set to yes and there was no AllowUsers or DenyUsers config line. Unless I am missing something, I don't think it is safe to assume it is locked by default – andrewtweber Nov 23 '16 at 3:26
  • @andrewtweber, root login is not prohibited via ssh config, but system wide by setting the root password to an invalid value that you can not enter. Thus, as I said, you can still ssh in as root using an RSA key, just not with a password. – psusi Jan 16 '17 at 3:15
  • ok thanks, can you add that explanation to your answer and then I'll be able to remove my downvote – andrewtweber Jan 16 '17 at 7:19
  • @andrewtweber, it's already in my answer.. – psusi Jan 16 '17 at 21:14
  • your explanation of how the root account is locked is not in your answer. Anyways I can't remove a downvote unless your answer is edited, so go ahead and be stubborn about it if you want – andrewtweber Jan 20 '17 at 4:28

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.