Sorry if this question has been asked before, but i cannot find it anywhere here or on google.

I set up public/private keys, imbedded into my VPS server successfully, it fully works using putty and authenticates and i log in and have full access.

My issue is that i dont want to allow root login, and this SSH key pair was created with root. How do i add the ssh public key to say "newuser" so i can ssh in with "newuser" and not "root" which i want to deny SSH access to?



NOTE: Do not remove anything other then the key from the file noted below at first.

Do not remove root password or root from sudoers until you are sure the new account can access everything through sudo.

  1. Log into the server with your root account. (Guessing this isn't Ubuntu on the server)

  2. Create a new user on the server and make sure they have sudo privileges. The Ubuntu way https://help.ubuntu.com/community/Sudoers, but since root is available on the server I am guessing it is not Ubuntu on there. Ask for further information if not clear on this.

User privilege specification


  1. Log out of the server.

  2. ssh into the server again this time into the new account

ssh newUSER@yourserver

  1. Test sudo with your your new account on the server with something non risky.

sudo apt-get update <<<<- If this lets you run the sudo command without complaining about not being in sudoers file/sudo group you have a working sudo account.

  1. nano or vim or use your favorite terminal editor to remove the keys from this file home/YOURUSERNAME/.ssh/authorized_keys
      • This file may be located elsewhere on other distributions, so either "find" or "locate" authorized_keys if not in above noted location. Since you are doing this to the file of the root account you will have to use "sudo locate" or "sudo find" for it to search root owned directories.

7.Log out again and copy your key to the new user. ssh-copy-id newUSER@yourserver

  1. Login using key and disable root login in /etc/ssh/sshd_config

    PermitRootLogin no

    9.requiers See if any application or service breaks because root doesn't have ssh access.

  2. If 9 doesn't break it you can disable root account entirely

    sudo passwd -l root

This will give the account an impossible to use password which makes it unusable until a new password is set. (requires sudo so test and test and test before removing anything.)

Excuse the formatting I'm new here and it's past my bed time.


A detailed tutorial (including information specific to Digital Ocean servers) guides you through the steps: Initial Server Setup with Ubuntu 16.04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.