How to Disable Root SSH Login and Create a Sudo User on Ubuntu (Best Practices)

Why Direct Root Login is a Critical Security Risk

In Linux systems administration, the root superuser possesses absolute power to modify files, delete databases, and reconfigure kernels without confirmation. Because the root username exists on every Linux system, 100% of automated brute-force attacks target this exact account name.

Enforcing the Principle of Least Privilege requires disabling direct root login and granting administrative privileges only via sudo, creating a traceable audit trail in system logs.

Step 1: Creating a Dedicated Administrative User

# Create a new non-root user (e.g. sysadmin)
sudo adduser sysadmin

# Add the user to the sudo administrative group
sudo usermod -aG sudo sysadmin

Step 2: Migrating SSH Keys to the New Sudo User

Copy your public SSH key to the new user’s profile to enable passwordless authentication:

# Create SSH directory with strict permissions
sudo mkdir -p /home/sysadmin/.ssh
sudo cp /root/.ssh/authorized_keys /home/sysadmin/.ssh/
sudo chown -R sysadmin:sysadmin /home/sysadmin/.ssh
sudo chmod 700 /home/sysadmin/.ssh
sudo chmod 600 /home/sysadmin/.ssh/authorized_keys

Step 3: Disabling Root Login in OpenSSH Configuration

sudo nano /etc/ssh/sshd_config

Locate the PermitRootLogin directive and update it:

# Disable direct root access
PermitRootLogin no

# Disable insecure password logins (SSH keys only)
PasswordAuthentication no

Step 4: Testing the Configuration and Restarting SSH

# Verify configuration syntax
sudo sshd -t

# Restart OpenSSH daemon
sudo systemctl restart ssh

Warning: Keep your existing root terminal session open! Open a second terminal window and test logging in with your new user:

ssh sysadmin@your-server-ip
sudo whoami  # Should output: root

Configuring Passwordless Sudo for Specific Automated Tasks

If you deploy automated CI/CD runners (such as GitHub Actions or GitLab Runners) using your sudo user, you can configure granular sudo permissions without exposing full root access. Edit the sudoers file using visudo:

sudo visudo -f /etc/sudoers.d/deployer

Allow the deployer user to restart Nginx and PHP-FPM without prompting for a password:

deployer ALL=(ALL) NOPASSWD: /usr/bin/systemctl reload nginx, /usr/bin/systemctl restart php8.3-fpm

Auditing Sudo Execution Logs in /var/log/auth.log

Every single command executed with sudo is recorded with an immutable timestamp, user identity, and working directory. Review administrative actions with:

sudo grep 'sudo:' /var/log/auth.log | tail -n 20

Advanced Sudo Privilege Configuration & User Expirations

In team development environments where multiple engineers access production infrastructure, granular sudoers rules ensure users only execute the exact tools required for their responsibilities:

# /etc/sudoers.d/developers
# Allow developer group to inspect system logs and reload web services only
%developers ALL=(ALL) /usr/bin/systemctl status *, /usr/bin/systemctl reload nginx, /usr/bin/journalctl

Setting Account Password Expiration and Inactivity Locks

Prevent orphaned administrative accounts from remaining accessible indefinitely by enforcing account expiration dates and automatic lockout policies:

# Set account password expiration to 90 days
sudo chage -M 90 sysadmin

# Lock inactive accounts automatically after 30 days of inactivity
sudo chage -I 30 sysadmin

# Review user password aging status
sudo chage -l sysadmin

Restricting Sudo Access by IP Address and Terminal TTY

For high-security production environments (such as financial or e-commerce servers), you can enforce PAM restrictions that prevent sudo privileges from being invoked unless the user is connected from a verified VPN IP address or physical local console:

# /etc/security/access.conf
# Allow sudo only from corporate VPN subnet
+ : sysadmin : 10.8.0.0/24 LOCAL
- : sysadmin : ALL

Setting Up Real-Time Slack or Telegram Alerts for Sudo Execution

To detect unauthorized privilege escalation instantly, configure a PAM session hook in /etc/pam.d/sudo that dispatches a webhook notification to your team’s Slack or Telegram channel whenever any administrative command is executed:

# /usr/local/bin/sudo-alert.sh
#!/bin/bash
if [ "$PAM_TYPE" = "open_session" ]; then
    MESSAGE="⚠️ Sudo session opened by ${PAM_USER} on $(hostname) at $(date)"
    curl -s -X POST -H 'Content-type: application/json' --data "{"text":"$MESSAGE"}" https://hooks.slack.com/services/YOUR/WEBHOOK/URL
fi

Auditing Sudo Permissions with Automated Security Benchmarks

Run automated Linux security auditing tools like Lynis to verify that user permissions, file ownership, and sudo policies conform to CIS (Center for Internet Security) Linux benchmark standards:

sudo apt install lynis -y
sudo lynis audit system --quick

Lynis analyzes your sudoers configuration, file permissions, and PAM authentication modules, generating a hardened compliance score and actionable remediation steps.

Frequently Asked Questions

Additionally, always remember to test sudo group access in a secondary terminal session before disconnecting your root session to avoid configuration lockouts.