How do I disable remote root login via ssh?

I want to log into my server (I use keys on my main comp) then su into root instead of access root directly.

I am using Debian. I follow guides online which say add PermitRootLogin no to the file and another mention Protocol 2. Then reset ssh. /etc/init.d/ssh restart. I did this and it did not work. I was able to log into root using putty.

How do I disable remote root login on Debian?

  • While you're at it, by the way, I suggest setting PasswordAuthentication no and ChallengeResponseAuthentication no, so that keys are required.
    – mattdm
    Mar 9, 2011 at 0:35
  • And you can also set AllowUsers acidzombie, so that only that account can log in.
    – mattdm
    Mar 9, 2011 at 0:39
  • @mattdm: Why require keys? I rather not have keys as if someone grabs my computer or somehow gets access to my private keys he could log in. I just have keys going into my account (which really is the same password as root but i type less) then su into it
    – user4069
    Mar 9, 2011 at 0:51
  • 1
    @acidzombie24: Keys because passwords can get brute forced, or stolen should the machine get compromised. Set a passphrase on your key, which will allow you time to change the authorized_keys if it's stolen.
    – mattdm
    Mar 9, 2011 at 1:08
  • @mattd: Isnt that redundant? Putting a password on my private keys instead of using that same password to log into my server? I rather use a password on server in case i am using someone elses machine.
    – user4069
    Mar 9, 2011 at 1:12

2 Answers 2


I'm going to take a guess on this one, but I'm pretty confident.

I bet there's a PermitRootLogin yes line already in your file. SSH will only use the first line it finds, and will ignore a duplicate further down. So if you just added PermitRootLogin no to the end of the file without removing the line above, there will be no effect.

  • +1 but wrong. After i did a search and found only that one line, i moved it to the very top of the file. Saved, restart ssh and tried logging in. It still allowed me :(
    – user4069
    Mar 9, 2011 at 0:50
  • 2
    @acidzombie24: Well, that's curious. Anything interesting logged? Just to be double-sure ("Is your computer plugged in?"), you're editing sshd_config, not ssh_config, right?
    – mattdm
    Mar 9, 2011 at 1:09
  • 1
    That was it, sshd_config. I didnt see it nor realize that the sites said to modify sshd. It didnt help when it said fine the lines with XYZ when the said lines are also in ssh_config. Problem solved.
    – user4069
    Mar 9, 2011 at 1:35

One of the peculiarities of ssh is that PAM-based authentication can't be fully controlled by it directly. You should check the PAM stack /etc/pam.d/sshd; I would add pam_access to the auth section (see pam_access(8) and access.conf(5) manual pages).

That said, PermitRootLogin No should work regardless. (PermitRootLogin without-password is the screw case.)

  • 1
    (And FWIW, ChallengeResponseAuthentication no is the solution to that "screw case".)
    – mattdm
    Mar 9, 2011 at 1:13
  • Usually, but not always. You may want to use PAM auth for S/Key / Opie (which at least some security regimes don't consider a "password"), SecurID, or other authentication mechanisms that ssh can't use directly.
    – geekosaur
    Mar 9, 2011 at 1:47

You must log in to answer this question.