Disabling root password sign-in over SSH

Question

How to block password sign-in for the root user over SSH?

Answer

The root user controls the full server. When SSH accepts the root password, attackers can try to guess it. To prevent this, let root sign in over SSH only with an SSH key.

Use the value PermitRootLogin prohibit-password. Do not use PermitRootLogin no: with it, the SSH Terminal extension in Plesk does not work. Also keep PubkeyAuthentication yes, because SSH Terminal signs in as root with a key.

Note: An error in the SSH configuration can lock you out of the server. Keep your current SSH session open until the last step is complete. Make sure that you have another way to get to the server, for example the console of your hosting provider.

1. Set up SSH key sign-in for root, or for a separate user with sudo rights. For example, on your local computer, run:

   # ssh-copy-id root@<server>

2. In a new terminal window, make sure that the key sign-in works:

   # ssh -o PreferredAuthentications=publickey root@<server>

   Do not continue if this step fails.

3. Connect to the Plesk server via SSH.

4. Create a backup copy of the SSH server configuration file. If the value is also set in an included file, create a backup copy of that file in the same way:

   # cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

5. Set PermitRootLogin prohibit-password in the SSH server configuration. The value can be in the /etc/ssh/sshd_config file or in a file that sshd_config includes, for example a file in the /etc/ssh/sshd_config.d/ directory. Change the value in each file where it is set. Also change it in each Match block that sets PermitRootLogin yes. To edit the file, use any text editor.

6. Check the configuration for errors:

   # sshd -t

   Note: On Debian and Ubuntu, this command can show "Missing privilege separation directory: /run/sshd". In this case, create the directory with mkdir -p /run/sshd and run the command again.

7. Restart the SSH service.

   For Plesk on CentOS / AlmaLinux / CloudLinux / RHEL:

   # systemctl restart sshd

   For Plesk on Debian / Ubuntu:

   # systemctl restart ssh

8. Check the value that SSH uses for a root sign-in from another computer:

   # sshd -T -C user=root,host=example.com,addr=203.0.113.1

   In the output, the line permitrootlogin must show prohibit-password or without-password. Both values mean the same: the OpenSSH version defines which name it shows. If the line shows yes, find the file or the Match block that still sets yes, and go back to step 5.

9. In a new terminal window, make sure that root can still sign in with the key. Then close the old session.