How to disable direct root login over SSH — PermitRootLogin

Server hardening, one change at a time: no direct root login — a normal user plus sudo instead.

Every flag and config keyword was checked against the OpenSSH 9.6 man pages, and the config examples were parsed for real with ssh -G.

PermitRootLogin no

Good to know

Middle ground: PermitRootLogin prohibit-password — root may still log in with a key, never with a password. Hardening rule from the cheatsheet: change one thing at a time, keep your current session open, and prove a fresh login works before you close it.

SSH Cheatsheet one-page card — commands that actually work — The full one-page card — SSH Cheatsheet. Get the complete cheatsheet on GitHub