How to Disable Root Login for Enhanced Server Security Print

The root user has full access to your server, making it a prime target for attackers. Disabling direct root login is a critical security measure that reduces the risk of unauthorized access and brute-force attacks. This guide will walk you through the steps to disable root login on your Linux server and explain why it’s important.

Why Disable Root Login?

• Prevent Brute-Force Attacks: Attackers often target the root account because it has unrestricted access. Disabling root login makes it harder for them to gain access.
• Limit Damage: If a non-root account is compromised, the attacker won’t have immediate root privileges, reducing the potential damage.
• Audit Trails: Using sudo creates logs of commands executed with root privileges, making it easier to track changes or identify unauthorized activity.

Step 1: Create a Non-Root User with Sudo Privileges

Before disabling root login, you must create a non-root user with sudo privileges. This ensures you can still perform administrative tasks after root login is disabled.

1. Log in to your server as the root user.
2. Create a new user:

   adduser username

   Replace username with your desired username.
3. Add the user to the sudo group:

   usermod -aG sudo username

4. Test the new user:
   • Log out of the root account:

     exit

   • Log in with the new user:

     ssh username@your_server_ip

   • Test sudo access by running:

     sudo ls /root

     If prompted for a password, enter the new user’s password.

Important: Ensure the new user can successfully use sudo before proceeding. If sudo access is not working, do not disable root login.

Step 2: Disable Root Login

Once you’ve confirmed the new user has sudo access, you can safely disable root login.

1. Open the SSH configuration file:

   sudo nano /etc/ssh/sshd_config

2. Find the line that says:

   #PermitRootLogin yes

   or

   PermitRootLogin yes

3. Change it to:

   PermitRootLogin no

4. Save the file and exit the editor (in nano, press CTRL + X, then Y, then Enter).
5. Restart the SSH service to apply the changes:

   sudo systemctl restart ssh

   (On some systems, the service may be called sshd instead of ssh.)

Warning: Do not close your current SSH session until you’ve verified that you can log in with the new user. If something goes wrong, you can still fix it using your current session.

Step 3: Verify the Changes

1. Open a new terminal window and attempt to log in as root using SSH:

   ssh root@your_server_ip

   You should receive an error like:

   Permission denied (publickey).

2. Log in with your non-root user:

   ssh username@your_server_ip

3. Use sudo to perform administrative tasks:

   sudo ls /root

Optional: Use SSH Keys for Authentication

For added security, disable password authentication and use SSH keys instead. This prevents brute-force attacks on your non-root account.

1. Generate an SSH key pair on your local machine (if you don’t already have one):

   ssh-keygen -t rsa -b 4096

   Follow the prompts to save the key pair.
2. Copy the public key to your server:

   ssh-copy-id username@your_server_ip

3. Open the SSH configuration file:

   sudo nano /etc/ssh/sshd_config

4. Ensure the following lines are set:

   PasswordAuthentication no

   PubkeyAuthentication yes

5. Restart the SSH service:

   sudo systemctl restart ssh

Important: Before disabling password authentication, ensure you can log in using your SSH key. If the key fails, you may lock yourself out of the server.

What to Do If You Lose Access

If you accidentally lock yourself out of your server, follow these steps to regain access:

1. Contact us by opening a support ticket to explain the issue.
2. Our team will assist you in re-enabling root login temporarily by editing the SSH configuration file:

   /etc/ssh/sshd_config

   and setting:

   PermitRootLogin yes

3. Once root login is re-enabled, you can log in and fix the issue.

Conclusion

Disabling root login is a simple yet effective way to enhance your server’s security. By requiring users to log in with a non-root account and use sudo for administrative tasks, you reduce the risk of unauthorized access and brute-force attacks. Combine this with other security measures like SSH keys and a firewall to keep your server safe.