How to Disable Remote Logon for Root on Ubuntu 16.04 LTS Servers

Allowing the root user to logon remotely to your server can be a dangerous thing… this is why Ubuntu gets installed with the root account unusable… It’s recommended that it stays that way to protect your servers…

Ubuntu root account isn’t disabled… it just doesn’t have a password. And without passwords, there will probably be no way for the root account to logon remotely either via SSH or other remote tools.

When you install openSSH server, the root account is allowed to logon. Again, it’s not a problem while the root account doesn’t have a password assigned… but if someone mistakenly assign a weak or temporary password to the root account, that can create a security hole on your systems.

This brief tutorial is going to show students and new users how to disable the root account from logging on remotely to your server. S0 even if the bad guys attempt to brute force their way in, they will not succeed.

To disable the root account from logging on remotely, follow the steps below:

Step 1: Disable SSH Logon for the Root User

The primary way for users to access their server remotely is via SSH. That’s because SSH allows for secure communications between the client machine and the server.

This is also the primary means of which attackers attempt to break into the system. If you want to hardened your server security, disable SSH root access. To do that, run the commands below to open openSSH configuration file.

sudo nano /etc/ssh/sshd_config

Then scroll down the file and change the line that permits root access from prohibit-password to no

PermitRootLogin no

# Authentication:

#LoginGraceTime 2m
PermitRootLogin no
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

Save the file and reload SSH service

sudo systemctl reload sshd.service

Step 2: Globally Disable Remote Root Logon

Alternatively, you can globally disable the root logon from remotely locations and only allow local logon via the console. To globally disable the root account from everywhere except local, open the access.conf file by running the commands below

sudo nano /etc/security/access.conf

Then add the line below into the file.

-:root:ALL EXCEPT LOCAL

Save the file and restart… and this will disable the root account from logging remotely, but allows local (console) logins.

This should do it.

Enjoy!