I have read a few times to disable root login and sudo as root using another user.
But is using a public key as good if not better security?
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
You should absolutely disable the ability to login as root remotely, and if at all possible also only allow login authentication to occur with the use of public/private key pairs (not password-only).
Have a look through this for best-practices on how to harden SSH (although this is provided as CentOS documentation, it applies in principal to any distribution under which you run sshd as your ssh daemon).
You should disable root login for remote host, but enable it from localhost.
Here are the important lines of most of my openssh server config file:
PermitRootLogin yes # because of AllowUsers
PasswordAuthentication no # connexion allowed only with keys
AllowUsers user root@localhost
You can still connect into root by using the
-A when connecting to your server as a simple user:
local $ ssh user@server -A
server $ ssh root@localhost