SSH root login
critical on-server
What it inspects
The effective SSH daemon configuration, read with `sshd -T` as root. The check fails when PermitRootLogin is `yes`. If `sshd -T` is not available it falls back to grepping /etc/ssh/sshd_config, where a non-yes value is only a warning because Include files are not followed.
Why it matters
Root exists on every Linux system, so an attacker already knows the username and only has to guess the credential. Allowing root to log in over SSH also removes the audit trail that comes from logging in as a named user and then using sudo. Disabling it makes brute-force attempts and stolen credentials far less useful.
How to verify
sudo sshd -T | grep -i '^permitrootlogin'How to fix
Set PermitRootLogin no in an sshd drop-in that sorts first, validate the config, then reload sshd. Confirm a key login for a non-root sudo user works before you do.
Disable root login with a drop-in and reload sshd
Debian / Ubuntu
# First confirm a key-based login for a sudo-capable non-root user works in a SECOND session.
if grep -q '^Include /etc/ssh/sshd_config.d' /etc/ssh/sshd_config; then
install -m 0644 /dev/stdin /etc/ssh/sshd_config.d/00-umbermark-ssh_permit_root_login.conf <<'EOF'
PermitRootLogin no
EOF
sshd -t && systemctl reload ssh
if ! sshd -t >/dev/null 2>&1; then rm -f /etc/ssh/sshd_config.d/00-umbermark-ssh_permit_root_login.conf; echo 'sshd -t failed: drop-in removed, nothing changed'; fi
else
echo 'sshd_config has no Include for sshd_config.d (older distro). Put these directives at the TOP of /etc/ssh/sshd_config instead, then run: sshd -t'
fi
RHEL / Rocky / Alma / Fedora
# First confirm a key-based login for a sudo-capable non-root user works in a SECOND session.
if grep -q '^Include /etc/ssh/sshd_config.d' /etc/ssh/sshd_config; then
install -m 0644 /dev/stdin /etc/ssh/sshd_config.d/00-umbermark-ssh_permit_root_login.conf <<'EOF'
PermitRootLogin no
EOF
sshd -t && systemctl reload sshd
if ! sshd -t >/dev/null 2>&1; then rm -f /etc/ssh/sshd_config.d/00-umbermark-ssh_permit_root_login.conf; echo 'sshd -t failed: drop-in removed, nothing changed'; fi
else
echo 'sshd_config has no Include for sshd_config.d (older distro). Put these directives at the TOP of /etc/ssh/sshd_config instead, then run: sshd -t'
fi