Knowledgebase | VPSGrid
English
EnglishBeta EspañolPortuguês (Brasil)Coming soonFrançaisComing soonDeutschComing soon
Client Area

How to Disable Root SSH Login

KB-148, Security, VPSGrid, unmanaged 0 found helpful

How to Disable Root SSH Login

Short answer

Create a normal user with sudo, confirm SSH login as that user (preferably with a key), keep a console/noVNC session ready, then set PermitRootLogin no in sshd_config and reload SSH. Never disable root login before the sudo user works.

Overview

Disabling direct root SSH reduces brute-force noise and forces named-user administration. This is a Linux hardening step for VPSGrid unmanaged VPS plans. Related: SSH Keys vs Password Login · Enable SSH Key Authentication.

Lockout warning

Open the browser noVNC console before changing SSH policy. Keep an existing root SSH session open until a second session works as the new sudo user.

Before you start

  • You can already SSH as root
  • You know your primary IP
  • Console access from the client area works

1) Create a sudo user

As root:

# Ubuntu / Debian
adduser deploy
usermod -aG sudo deploy

# AlmaLinux / Rocky Linux
adduser deploy
passwd deploy
usermod -aG wheel deploy

Replace deploy with your preferred username. Confirm sudo works:

su - deploy
sudo -v
# enter the user password if prompted; exit back to root when done testing

2) Enable SSH for that user (key recommended)

  1. Install the user’s public key in ~deploy/.ssh/authorized_keys (ownership deploy:deploy, mode 700 for .ssh and 600 for the file)
  2. From your computer, open a new terminal and test:
ssh deploy@YOUR_PRIMARY_IP
sudo whoami
# should print: root

Do not continue until this works.

3) Disable root SSH login

Edit the SSH daemon config (as root or via sudo):

sudo nano /etc/ssh/sshd_config
# or: sudo nano /etc/ssh/sshd_config.d/99-vpsgrid-hardening.conf

Set (or add):

PermitRootLogin no

Optional stronger combo after keys work for the sudo user:

PasswordAuthentication no
PubkeyAuthentication yes

Validate and reload:

# syntax check (command name varies by distro)
sudo sshd -t || sudo sshd -t -f /etc/ssh/sshd_config

# reload without dropping other sessions
sudo systemctl reload sshd 2>/dev/null || sudo systemctl reload ssh

4) Verify and only then disconnect root

  1. From a new local terminal: ssh deploy@YOUR_PRIMARY_IP still works
  2. Confirm ssh root@YOUR_PRIMARY_IP is rejected
  3. Only then close the old root session

Rollback if something goes wrong

  1. Open noVNC/console from the client area
  2. Log in as root locally
  3. Set PermitRootLogin yes (temporarily), reload sshd, fix the sudo user/key, then harden again

Important notes

  • Disabling root SSH is not the same as deleting the root account
  • Windows VPS plans use RDP, not this Linux sshd setting
  • VPSGrid support does not apply guest SSH hardening for you on unmanaged plans

Frequently Asked Questions

Should I disable root before adding a sudo user?

No. Always prove sudo-user SSH works first.

Can I still use root after this?

Yes via sudo -i / sudo su - after logging in as your sudo user, or via the console.

I locked myself out

Use the browser console, restore PermitRootLogin, reload sshd, then repair user/key settings.

Related Articles

Need More Help?

Open a ticket at billing.vpsgrid.net with your service ID, whether console works, and the exact sshd error after the change.

Was this answer helpful?

Related Articles

« Back Browse all articles