I recently disabled root login via ssh on my ubunutu server as I was getting quite a lot of ssh attempts with root. I did this by editing the /etc/ssh/sshd_config file and restarting ssh.

However, when I recently checked my log file again, I saw there were numerous other attempts with root in there? - The log message was "failed password" - but if this did work, why would it simply not fail at the first hurdle and say "failed - root login disallowed" or something similar?

Is there a way to tell whether I have configured this correctly?

  • Try to ssh to the box login in as root with the correct password.
    – user105924
    Jan 4, 2012 at 16:36
  • I haven't set a password for root Jan 4, 2012 at 16:38

3 Answers 3


I assume you set the PermitRootLogin to no. If this is the case, SSH will still accept the connection but then deny root login. You will see this in the logs but it will not permit root to login.

I also use the "without-password" option to permit root login only with SSH keys.

I've not dug into it but suspect this is because SSH accepts the connection and then hands the authentication process to PAM.

If you wish to block these attempts, fail2ban is a popular tool for this purpose.


Personally, I am not a fan of these log analyzers but they have their place.

  • right, thanks for clarifying - yes that's what I did Jan 4, 2012 at 17:13
  • I also tweak /etc/pam.d/su to only permit users in the wheel group to su to root. Then add your admins to the wheel group and/or use sudo. This provides many layers of security. Jan 4, 2012 at 17:17

If you set :

PermitRootLogin no

and restart sshd process (/etc/init.d/sshd restart). It should disable the ability of the root user to login. Make sure that /etc/sysconfig/sshd doesn't exist and overwrite some of the settings.

The log error, upon root login will be something like (in /var/log/secure if RHEL based distro):

Failed password for root from [...]*

A tips could be to install something like sshguard to help battle bruteforce attempts. Read about it at:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.