Disable Root SSH Login¶

Introduction¶

This guide explains disable root ssh login as an operational security task. The focus is practical hardening, auditability, and verification on real Linux servers.

Why This Matters¶

Security settings fail when they are copied without testing. You need to know what the control protects, how to prove it is active, and how to troubleshoot denied access without weakening the host.

Before You Start¶

Capture the current state and keep a rollback path. For remote systems, keep an existing root or console session open before changing SSH, sudo, firewall, or SELinux policy.

sudo systemctl status sshd
sudo journalctl -u sshd -n 50 --no-pager
sudo sshd -t

Step-by-Step Configuration¶

Apply the smallest change that enforces the desired policy. For access controls, prefer group-based rules and persistent configuration over one-off manual fixes.

sudo systemctl restart sshd
ssh -vvv admin@server.example.com

Verification¶

sudo systemctl status sshd
sudo journalctl -u sshd -n 50 --no-pager

Expected evidence:

Active: active (running)
Accepted publickey for admin from 192.0.2.50 port 51244 ssh2

Security Best Practices¶

• Keep SELinux enforcing unless a temporary exception is documented.
• Prefer key-based SSH, least-privilege sudo rules, and minimal listening services.
• Review logs after making access-control changes.
• Patch through tested package repositories instead of manual binary replacement.

Common Mistakes¶

• Making several changes at once, which hides the real cause.
• Skipping logs or verification commands after a change.
• Assuming the problem is fixed because one command returned successfully.

Troubleshooting¶

If access is blocked, check standard permissions first, then SELinux labels or booleans, then firewall rules, then application logs. The failing layer should leave evidence in logs or command output.

Related Guides¶

• SELinux Troubleshooting Guide
• SSH Security Best Practices
• Secure Sudo Configuration
• Linux Hardening Checklist

Summary¶

Treat disable root ssh login as a controlled change: inspect, configure, verify, and document the evidence. Security that cannot be verified is not reliable.