---
title: How to disable root ssh with password but enable via ssh keys
description: "Disabling root SSH access with a password while allowing login via SSH keys is a highly recommended security practice. This ensures that only users with the correct SSH key can access the root account, eliminating the risk of brute-force attacks…"
url: "https://truehost.com/support/knowledge-base/how-to-disable-root-ssh-with-password-but-enable-via-ssh-keys/"
updated: "2024-10-08"
category: Cloud servers in Kenya
---

# How to disable root ssh with password but enable via ssh keys

Disabling root SSH access with a password while allowing login via SSH keys is a highly recommended security practice. This ensures that only users with the correct SSH key can access the root account, eliminating the risk of brute-force attacks on root passwords.

## Prerequisites

1. **SSH Access to the Server**:
   - You must have SSH access to the server as either the **root** user or a **sudo user**.
2. **Root SSH Key**:
   - You should already have an **SSH key configured** for the root user, or you need to set one up before disabling password access.
   - If you don’t have an SSH key yet, follow **[these instructions](https://truehost.com/support/knowledge-base/how-to-configure-ssh-key-for-a-user/)** to generate and copy an SSH key to the server before proceeding.
3. **Sudo User with SSH Access** (Optional but recommended):
   - It’s always good practice to have a **[non-root sudo user](https://truehost.com/support/knowledge-base/how-to-create-a-sudo-user-on-your-server/)** with SSH access for emergency purposes.

## **Step-by-Step Guide to Disable Root SSH with Password but Enable SSH Keys**

Follow the steps below to

##### **Step 1: Verify or Set Up SSH Keys for Root**

- If you haven't generated SSH key on your local machine and uploaded it on the server, follow **[these steps](https://truehost.com/support/knowledge-base/how-to-configure-ssh-key-for-a-user/)** to generate and uplaod the key.

##### **Step 2: Backup the SSH Configuration File**

- Access the server via SSH as guided **[here](https://truehost.com/support/knowledge-base/how-to-access-a-server-via-ssh-terminal/)**.
- Before making any changes on the server, back up the current SSH configuration on the server. This ensures you can restore the original settings if something goes wrong.

```
cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
```

##### **Step 3: Edit the SSH Configuration File**

- If you have not installed **vim** or **nano**, you may want to install them first using either **sudo apt-get install vim**/ **sudo apt-get install nano**(ubuntu, dedian, mint) or**sudo yum install vim** /**sudo yum install**nano (centos, almalinux, redhat)

![](https://truehost.com/support/wp-content/uploads/2024/10/image-192-1024x718.png)

- Open the SSH configuration file for editing, using your favorite text editor like **nano** or **vim**.

```
vim /etc/ssh/sshd_config
```

```
nano /etc/ssh/sshd_config
```

![](https://truehost.com/support/wp-content/uploads/2024/10/image-193.png)

Look for the following lines (you may need to uncomment some of them):

**A. Disable root login with a password**: Find the line that specifies **PermitRootLogin** & modify it as follows:

```
PermitRootLogin prohibit-password
```

- This setting allows root login **only via SSH keys** and **disables password-based root logins**.

![](https://truehost.com/support/wp-content/uploads/2024/10/image-194.png)

**B. Disable password authentication (for all users)**: For extra security, you may want to disable password authentication entirely and enforce SSH key authentication for all users. Do that by adding this setting below. Well, unless if you really want to, I would suggest you do not disable passwords for all users. S

```
PasswordAuthentication no
```

![](https://truehost.com/support/wp-content/uploads/2024/10/image-195.png)

##### **Step 4: Reload the SSH Service**

To apply the changes, reload the SSH service:

```
systemctl reload sshd OR systemctl reload sshd.service
```

**Step 5: Test SSH Key Login for Root**

- **Do not log out** of your current session yet.
- Open a new terminal window and test the SSH key-based login for root:

```
ssh root@your_server_ip
```

- If the login succeeds, your SSH keys are working correctly. You can now close your original session.

![](https://truehost.com/support/wp-content/uploads/2024/10/image-196.png)

- If you want to disable password authentication for all users other than root (I discourage), proceed to step 6 below,

**Step 6: Ensure Non-Root Users Can Still Log In (Optional)**

- If you are enforcing SSH keys for all users, make sure that any non-root users also have their SSH keys set up. Otherwise, they will be locked out once password authentication is disabled.
- To add SSH keys for a non-root user, follow the same steps as for root: log in as the non-root user and place the public key in `~/.ssh/authorized_keys` for that user.
- Alternatively use the command below; replace ***username*** with the actual user

```
ssh-copy-id useraneme@your_server_ip
```

##### **Step 7: Restart SSH Service (If Required)**

After making final adjustments, you can restart the SSH service to ensure everything is properly configured:

```
systemctl restart sshd OR systemctl restart sshd.service
```