How to Disable Root Login on Linux.

The root account has full control over a Linux system. For routine administration, it is usually safer to sign in with a named user account and use sudo when elevated privileges are needed. This gives system logs a clearer link to the person who initiated an administrative command and avoids using a shared root password.

This guide explains how to check administrative access, lock the root password, and prevent root from logging in over SSH. The commands use Ubuntu and Debian conventions; other distributions may use a different administrator group or service name.

Before changing access: Keep your current session open, confirm that a separate account can use sudo, and test a second login session before closing the first. This is especially important on remote servers.

ROOT account

root is the Unix and Linux superuser, usually with user ID number of 0 (zero). It can read and change nearly any file, manage users and services, and alter system settings.

There are several different ways to obtain root privileges:

• Direct login as root, locally or remotely.
• su, which starts a shell as another user and commonly requires that account’s password.
• sudo, which lets authorized users run commands with elevated privileges under the system’s sudo policy.

These are separate access paths. Locking the root password does not disable sudo, and changing the SSH policy does not prevent someone with sudo privileges from running commands as root.

Why restrict direct root login?

Disabling direct root login can reduce exposure to password guessing over SSH and makes it harder to use an unaccountable shared root login. Named accounts also make administrative activity easier to attribute.

It does not prevent all privilege escalation, nor does it make a system secure on its own. Protect user accounts, SSH keys, sudo permissions, and recovery access as well.

1. Verify sudo access

On Ubuntu and Debian, users in the sudo group are commonly allowed to use sudo. Check your current account:

$ id -nG
$ sudo -v

The first command lists your groups. The second verifies that sudo authentication works. Do this before locking root or changing SSH configuration.

To add an existing user to the sudo group on Ubuntu or Debian, run the following from an account that already has administrative privileges:

$ sudo usermod -aG sudo USERNAME

Replace USERNAME with the account name. The -a option appends the group without removing other supplementary group memberships. The user must sign out and back in for the new group membership to appear. Then verify it with id -nG and test sudo -v.

Other distributions may use a different group, such as wheel, or a different sudoers policy. Check your distribution’s documentation rather than assuming the sudo group applies.

2. Lock password authentication for root

If you do not need a root password, lock it with:

$ sudo passwd -l root

This locks the root password by changing its password hash. It prevents authentication methods that rely on that password, but it does not necessarily disable every possible way to access the root account. For example, SSH public-key access is controlled separately by SSH daemon configuration, and privileged users may still use sudo or other configured mechanisms.

Check the password status with:

$ sudo passwd -S root

On many Linux distributions, an L status indicates that the password is locked. The exact output format can vary.

Do not use the contents of /etc/shadow as the primary verification method. Its format and locked-password marker can vary, and it contains sensitive password data.

3. Disable root login over SSH

OpenSSH controls remote root login with the PermitRootLogin setting. Set it to no to prohibit root logins through SSH, including key-based root login:

PermitRootLogin no

On Ubuntu and Debian, SSH settings may also be provided in /etc/ssh/sshd_config.d/*.conf. Because OpenSSH generally uses the first value it reads for a setting, a conflicting earlier value in an included file may take precedence. Inspect the existing configuration and snippets before adding a new setting.

Edit the appropriate file with your preferred editor. For example:

$ sudo nano /etc/ssh/sshd_config

If you use a configuration snippet, choose a filename and ensure it is included by the main configuration. Do not blindly add a duplicate setting without checking which value will take effect.

Before reloading or restarting SSH, validate the configuration:

$ sudo sshd -t

If the command returns an error, fix the configuration before proceeding. On Ubuntu and Debian, restart the service with:

$ sudo systemctl restart ssh.service

Other distributions may name the service sshd. Keep your existing SSH session open and verify that a new session can connect with your named administrator account before closing it.

Check the effective SSH setting with:

$ sudo sshd -T | grep -i '^permitrootlogin'

Expected output:

permitrootlogin no

The sshd -T command prints the server’s effective configuration. If it reports a different value, review included configuration files and any Match blocks that may alter settings for particular users or connections.

About restricting su

Avoid changing /bin/su permissions with chmod or changing its group ownership as a general hardening step. Those edits can conflict with distribution-managed file permissions and package updates, and they do not replace a properly configured sudo policy.

If you need to limit who can use su, use your distribution’s supported PAM or access-control configuration and test it carefully. For many systems, a simpler approach is to keep the root password locked and manage administrative permissions through sudoers.

What these changes do—and do not do

• Locking root’s password prevents password-based root authentication, but does not alone disable all root access methods.
• PermitRootLogin no prevents direct root login over SSH.
• Authorized users can still run commands as root with sudo, according to the sudoers policy.
• The root account remains part of the system; these steps do not delete it.
• Users with sudo privileges can still obtain broad administrative access. Grant those privileges only to trusted accounts.

Restricting direct root access is a useful way to reduce unnecessary exposure and make routine administration more accountable. First confirm that a named administrator can use sudo, then lock root’s password if appropriate and set PermitRootLogin no for SSH. Validate the SSH configuration and test a new login before ending your current session.

Keep learning. Keep exploring. Stay secure.