Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I disable remote root login via ssh?

I want to log into my server (I use keys on my main comp) then su into root instead of access root directly.

I am using Debian. I follow guides online which say add PermitRootLogin no to the file and another mention Protocol 2. Then reset ssh. /etc/init.d/ssh restart. I did this and it did not work. I was able to log into root using putty.

How do I disable remote root login on Debian?

share|improve this question
While you're at it, by the way, I suggest setting PasswordAuthentication no and ChallengeResponseAuthentication no, so that keys are required. – mattdm Mar 9 '11 at 0:35
And you can also set AllowUsers acidzombie, so that only that account can log in. – mattdm Mar 9 '11 at 0:39
@mattdm: Why require keys? I rather not have keys as if someone grabs my computer or somehow gets access to my private keys he could log in. I just have keys going into my account (which really is the same password as root but i type less) then su into it – acidzombie24 Mar 9 '11 at 0:51
@acidzombie24: Keys because passwords can get brute forced, or stolen should the machine get compromised. Set a passphrase on your key, which will allow you time to change the authorized_keys if it's stolen. – mattdm Mar 9 '11 at 1:08
@mattd: Isnt that redundant? Putting a password on my private keys instead of using that same password to log into my server? I rather use a password on server in case i am using someone elses machine. – acidzombie24 Mar 9 '11 at 1:12
up vote 10 down vote accepted

I'm going to take a guess on this one, but I'm pretty confident.

I bet there's a PermitRootLogin yes line already in your file. SSH will only use the first line it finds, and will ignore a duplicate further down. So if you just added PermitRootLogin no to the end of the file without removing the line above, there will be no effect.

share|improve this answer
+1 but wrong. After i did a search and found only that one line, i moved it to the very top of the file. Saved, restart ssh and tried logging in. It still allowed me :( – acidzombie24 Mar 9 '11 at 0:50
@acidzombie24: Well, that's curious. Anything interesting logged? Just to be double-sure ("Is your computer plugged in?"), you're editing sshd_config, not ssh_config, right? – mattdm Mar 9 '11 at 1:09
That was it, sshd_config. I didnt see it nor realize that the sites said to modify sshd. It didnt help when it said fine the lines with XYZ when the said lines are also in ssh_config. Problem solved. – acidzombie24 Mar 9 '11 at 1:35

One of the peculiarities of ssh is that PAM-based authentication can't be fully controlled by it directly. You should check the PAM stack /etc/pam.d/sshd; I would add pam_access to the auth section (see pam_access(8) and access.conf(5) manual pages).

That said, PermitRootLogin No should work regardless. (PermitRootLogin without-password is the screw case.)

share|improve this answer
(And FWIW, ChallengeResponseAuthentication no is the solution to that "screw case".) – mattdm Mar 9 '11 at 1:13
Usually, but not always. You may want to use PAM auth for S/Key / Opie (which at least some security regimes don't consider a "password"), SecurID, or other authentication mechanisms that ssh can't use directly. – geekosaur Mar 9 '11 at 1:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.