{"id":1375,"date":"2026-09-03T11:37:53","date_gmt":"2026-09-03T06:07:53","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-disable-root-ssh-login-create-sudo-user-ubuntu\/"},"modified":"2026-09-03T12:32:24","modified_gmt":"2026-09-03T07:02:24","slug":"how-to-disable-root-ssh-login-create-sudo-user-ubuntu","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-disable-root-ssh-login-create-sudo-user-ubuntu\/","title":{"rendered":"How to Disable Root SSH Login and Create a Sudo User on Ubuntu (Best Practices)"},"content":{"rendered":"
\n

\n Quick Answer:<\/strong> To disable root login on Ubuntu, create a new administrative user (adduser deployer<\/code>), add the user to the sudo group (usermod -aG sudo deployer<\/code>), copy authorized SSH keys to \/home\/deployer\/.ssh\/<\/code>, edit \/etc\/ssh\/sshd_config<\/code> to set PermitRootLogin no<\/code>, and restart OpenSSH with sudo systemctl restart ssh<\/code>.\n <\/p>\n<\/div>\n

Why Direct Root Login is a Critical Security Risk<\/h2>\n

In Linux systems administration, the root<\/code> superuser possesses absolute power to modify files, delete databases, and reconfigure kernels without confirmation. Because the root<\/code> username exists on every Linux system, 100% of automated brute-force attacks target this exact account name.<\/p>\n

Enforcing the Principle of Least Privilege<\/strong> requires disabling direct root login and granting administrative privileges only via sudo<\/code>, creating a traceable audit trail in system logs.<\/p>\n

Step 1: Creating a Dedicated Administrative User<\/h2>\n
# Create a new non-root user (e.g. sysadmin)\nsudo adduser sysadmin\n\n# Add the user to the sudo administrative group\nsudo usermod -aG sudo sysadmin<\/pre>\n
Step 2: Migrating SSH Keys to the New Sudo User<\/h2>\n
Copy your public SSH key to the new user’s profile to enable passwordless authentication:<\/p>\n
# Create SSH directory with strict permissions\nsudo mkdir -p \/home\/sysadmin\/.ssh\nsudo cp \/root\/.ssh\/authorized_keys \/home\/sysadmin\/.ssh\/\nsudo chown -R sysadmin:sysadmin \/home\/sysadmin\/.ssh\nsudo chmod 700 \/home\/sysadmin\/.ssh\nsudo chmod 600 \/home\/sysadmin\/.ssh\/authorized_keys<\/pre>\n
Step 3: Disabling Root Login in OpenSSH Configuration<\/h2>\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n
Locate the PermitRootLogin<\/code> directive and update it:<\/p>\n
# Disable direct root access\nPermitRootLogin no\n\n# Disable insecure password logins (SSH keys only)\nPasswordAuthentication no<\/pre>\n
Step 4: Testing the Configuration and Restarting SSH<\/h2>\n
# Verify configuration syntax\nsudo sshd -t\n\n# Restart OpenSSH daemon\nsudo systemctl restart ssh<\/pre>\n
Warning:<\/strong> Keep your existing root terminal session open! Open a second terminal window and test logging in with your new user:<\/p>\n
ssh sysadmin@your-server-ip\nsudo whoami  # Should output: root<\/pre>\n
Configuring Passwordless Sudo for Specific Automated Tasks<\/h2>\n
If you deploy automated CI\/CD runners (such as GitHub Actions or GitLab Runners) using your sudo user, you can configure granular sudo permissions without exposing full root access. Edit the sudoers file using visudo<\/code>:<\/p>\n
sudo visudo -f \/etc\/sudoers.d\/deployer<\/pre>\n
Allow the deployer user to restart Nginx and PHP-FPM without prompting for a password:<\/p>\n
deployer ALL=(ALL) NOPASSWD: \/usr\/bin\/systemctl reload nginx, \/usr\/bin\/systemctl restart php8.3-fpm<\/pre>\n
Auditing Sudo Execution Logs in \/var\/log\/auth.log<\/h2>\n
Every single command executed with sudo<\/code> is recorded with an immutable timestamp, user identity, and working directory. Review administrative actions with:<\/p>\n
sudo grep 'sudo:' \/var\/log\/auth.log | tail -n 20<\/pre>\n
Advanced Sudo Privilege Configuration & User Expirations<\/h2>\n
In team development environments where multiple engineers access production infrastructure, granular sudoers rules ensure users only execute the exact tools required for their responsibilities:<\/p>\n
# \/etc\/sudoers.d\/developers\n# Allow developer group to inspect system logs and reload web services only\n%developers ALL=(ALL) \/usr\/bin\/systemctl status *, \/usr\/bin\/systemctl reload nginx, \/usr\/bin\/journalctl<\/pre>\n
Setting Account Password Expiration and Inactivity Locks<\/h2>\n
Prevent orphaned administrative accounts from remaining accessible indefinitely by enforcing account expiration dates and automatic lockout policies:<\/p>\n
# Set account password expiration to 90 days\nsudo chage -M 90 sysadmin\n\n# Lock inactive accounts automatically after 30 days of inactivity\nsudo chage -I 30 sysadmin\n\n# Review user password aging status\nsudo chage -l sysadmin<\/pre>\n
Restricting Sudo Access by IP Address and Terminal TTY<\/h2>\n
For high-security production environments (such as financial or e-commerce servers), you can enforce PAM restrictions that prevent sudo privileges from being invoked unless the user is connected from a verified VPN IP address or physical local console:<\/p>\n
# \/etc\/security\/access.conf\n# Allow sudo only from corporate VPN subnet\n+ : sysadmin : 10.8.0.0\/24 LOCAL\n- : sysadmin : ALL<\/pre>\n
Setting Up Real-Time Slack or Telegram Alerts for Sudo Execution<\/h2>\n
To detect unauthorized privilege escalation instantly, configure a PAM session hook in \/etc\/pam.d\/sudo<\/code> that dispatches a webhook notification to your team’s Slack or Telegram channel whenever any administrative command is executed:<\/p>\n
# \/usr\/local\/bin\/sudo-alert.sh\n#!\/bin\/bash\nif [ \"$PAM_TYPE\" = \"open_session\" ]; then\n    MESSAGE=\"\u26a0\ufe0f Sudo session opened by ${PAM_USER} on $(hostname) at $(date)\"\n    curl -s -X POST -H 'Content-type: application\/json' --data \"{\"text\":\"$MESSAGE\"}\" https:\/\/hooks.slack.com\/services\/YOUR\/WEBHOOK\/URL\nfi<\/pre>\n
Auditing Sudo Permissions with Automated Security Benchmarks<\/h2>\n
Run automated Linux security auditing tools like Lynis<\/strong> to verify that user permissions, file ownership, and sudo policies conform to CIS (Center for Internet Security) Linux benchmark standards:<\/p>\n
sudo apt install lynis -y\nsudo lynis audit system --quick<\/pre>\n
Lynis analyzes your sudoers configuration, file permissions, and PAM authentication modules, generating a hardened compliance score and actionable remediation steps.<\/p>\n
\n
\n        \ud83d\udd17<\/span> Recommended Related Technical Guides:
\n    <\/h3>\n