How to Disable Root Login in Linux

In every Linux-based system, the root user holds the highest administrative privileges. This account can perform any operation, modify any configuration, and access any part of the system. However, while powerful, the root account is also a major security risk. If an attacker gains access to it, they can completely compromise your server.

Disabling the root login helps tighten security by ensuring that only specific users — typically administrators with sudo privileges — can perform system-level tasks. With this configuration, users must authenticate themselves through sudo before executing any privileged command, providing an additional layer of protection and accountability.

⚠️ Important: Before disabling the root account, make sure you already have a non-root user with sudo privileges. Without it, you could lose access to critical administrative capabilities.

Prerequisites

Before you begin, ensure the following conditions are met:

• You have access to your Linux instance through SSH or a local terminal.
• You are logged in as a non-root user with sudo privileges.
• You understand basic Linux command-line operations.

Step 1: Disable Root SSH Login

The Secure Shell (SSH) protocol is the standard method for remotely connecting to Linux systems. By default, many systems allow the root user to log in directly over SSH, which is a security concern. Disabling root SSH login ensures that even if someone obtains the root password, they cannot connect remotely as the root user.

Follow these steps:

1. Open the SSH configuration file with a text editor:
   sudo nano /etc/ssh/sshd_config
2. Locate the following line:
   PermitRootLogin yes
3. Change its value to:
   PermitRootLogin no
4. Save and close the file by pressing Ctrl + O, Enter, and then Ctrl + X.
5. Restart the SSH service to apply the changes:
   sudo systemctl restart sshd

Tip: Some distributions name the service ssh instead of sshd. You can verify by running:
systemctl status sshd

Once this change is applied, your system will reject all SSH login attempts using the root account.

Step 2: Disable Access to the Root User Shell

Disabling SSH access isn’t enough — users could still gain root access locally or by using sudo su. To fully restrict root access, you can modify the system shell associated with the root user. This change ensures that whenever someone tries to switch to the root account, they’ll be greeted with an error message instead of an interactive shell.

1. Open the /etc/passwd file:
   sudo nano /etc/passwd
2. Locate the line starting with root and replace the shell path /bin/bash (or similar) with /sbin/nologin:
   root:x:0:0:root:/root:/sbin/nologin
3. Save and close the file.

The /sbin/nologin shell prevents interactive logins and displays a default message:
This account is currently not available.

To protect the /etc/passwd file from unauthorized modifications, make it immutable:
sudo chattr +i /etc/passwd

This command applies an immutable attribute, which prevents any process — even the root user — from modifying or deleting the file.

⚠️ Note: To make changes in the future, you must first remove the immutable flag:
sudo chattr -i /etc/passwd

Test the change by running:
sudo su

You should see the following message:
This account is currently not available.

This confirms that the root shell is successfully disabled.

Step 3: Create a Custom Message of the Day (MOTD)

The Message of the Day (MOTD) is displayed whenever a user logs into a Linux system. It can be customized to provide security reminders, usage policies, or administrative instructions. In this case, you can use it to inform users that the root account has been disabled and that they should use sudo for administrative commands.

1. Open the /etc/motd file:
   sudo nano /etc/motd
2. Add a custom message, for example:
   Welcome to the server! Note: The root account is disabled for security reasons. Please use sudo to execute administrative commands.
3. Save and close the file.

Now, whenever someone logs in, they will see this message — a helpful reminder to follow proper administrative practices.

Step 4: Verify Root Login is Disabled

After applying all the above changes, you should verify that root login is fully disabled across all access methods.

1. Test via Terminal
   Try switching to the root account:
   sudo su
   You should see:
   This account is currently not available.
2. Test via SSH
   Attempt to log in using SSH as the root user:
   ssh root@your_server_ip
   Expected output:
   Permission denied, please try again. Received disconnect from your_server_ip port 22:2: Too many authentication failures Disconnected from your_server_ip port 22
3. Test via Console or Display Manager
   If you attempt to log in as root locally (through tty1 or a graphical display manager), the session should immediately terminate, confirming that the account is disabled.

Step 5 (Optional): Re-enable Root Access (If Needed)

If you need to temporarily re-enable the root account for maintenance or recovery, follow these steps:

1. Remove immutability from /etc/passwd:
   sudo chattr -i /etc/passwd
2. Change the root shell back to /bin/bash:
   sudo nano /etc/passwd
   Replace:
   /sbin/nologin
   with:
   /bin/bash
3. Re-enable root SSH access (if required):
   sudo nano /etc/ssh/sshd_config
   Change:
   PermitRootLogin no
   to:
   PermitRootLogin yes
4. Restart SSH:
   sudo systemctl restart sshd

Remember to disable root login again after completing your administrative tasks to maintain security best practices.

Conclusion

You have now successfully disabled the root user login on your Linux workstation. This configuration enhances your system’s overall security by limiting administrative access to verified sudo users.

By disabling direct root logins — both through SSH and the local shell — and protecting the /etc/passwd file, you significantly reduce the attack surface available to malicious actors. The addition of a custom Message of the Day (MOTD) further improves clarity for users, ensuring they know how to perform privileged actions safely.

Regularly enforcing such security measures helps maintain a hardened and secure Linux environment, where privileges are tightly controlled and unauthorized access is effectively prevented.