Many VPS images let you log in as root straight away. It’s convenient, but every bot on the internet knows the username root, and a single mistake typed as root has no safety net. The standard practice: log in as a normal user with sudo, and forbid root logins over SSH.

1. Create a regular user

Logged in as root:

Ubuntu / Debian:

adduser alice
usermod -aG sudo alice

AlmaLinux / Rocky:

adduser alice
passwd alice
usermod -aG wheel alice

The sudo group (Debian family) or wheel group (RHEL family) is allowed to run commands as root via sudo.

2. Give the user your SSH key

If root already logs in with your key, copy it across:

mkdir -p /home/alice/.ssh
cp /root/.ssh/authorized_keys /home/alice/.ssh/
chown -R alice:alice /home/alice/.ssh
chmod 700 /home/alice/.ssh
chmod 600 /home/alice/.ssh/authorized_keys

Otherwise, from your computer: ssh-copy-id [email protected]. New to keys? See creating SSH keys with ssh-keygen.

3. Test the new user — in a new terminal

Keep the root session open. In a second terminal:

ssh [email protected]
sudo whoami        # should print: root

Don’t continue until both commands work.

4. Disable root login

Create a drop-in config file:

echo "PermitRootLogin no" | sudo tee /etc/ssh/sshd_config.d/10-no-root.conf

Check that nothing else overrides it. sshd uses the first value it reads for each setting, and files in sshd_config.d/ are read in alphabetical order before the rest of the main file:

sudo grep -rn "PermitRootLogin" /etc/ssh/sshd_config /etc/ssh/sshd_config.d/
sudo sshd -T | grep -i permitrootlogin      # the effective value

sshd -T shows the final, effective configuration — it should print permitrootlogin no.

Validate and reload:

sudo sshd -t
sudo systemctl reload ssh      # "sshd" on AlmaLinux/Rocky

5. Confirm

From your computer:

ssh [email protected]
# [email protected]: Permission denied (publickey).

And your regular user still works.

PermitRootLogin options

Value Effect
no Root can’t log in over SSH at all
prohibit-password Root can log in with a key, not a password (the OpenSSH default)
forced-commands-only Root key login only for keys with a command= restriction
yes Root can log in with anything enabled

prohibit-password is a reasonable middle ground if automation needs root (some backup tools). For humans, no plus sudo is better: actions are tied to named accounts and logged.

Also disable passwords entirely

While you’re here, if every user logs in with keys:

PasswordAuthentication no
KbdInteractiveAuthentication no

See SSH key authentication only.

Working as root when you need to

sudo command          # one command
sudo -i               # a root login shell
sudo -u www-data bash # a shell as another user

sudo logs every command to the auth log (/var/log/auth.log or the journal), which is invaluable after an incident. To configure who may run what, see sudo and sudoers.

Optional: restrict who may log in at all

AllowUsers alice deploy
# or
AllowGroups sshusers

Anyone not listed is refused, even with a valid key — a strong safeguard against forgotten accounts.

If you lock yourself out

Use the VNC console from your VPS control panel. The console logs in locally, so PermitRootLogin doesn’t apply there. Fix the config, then sudo systemctl reload ssh.

Checklist

  • Regular user created and in the sudo/wheel group
  • SSH key installed for that user and tested
  • PermitRootLogin no effective (sshd -T)
  • Password authentication disabled
  • Root login attempt refused

Next steps: change the SSH port, add Fail2Ban, and work through the Linux server hardening checklist.

  • SSH
  • Security
  • Linux