Root login
Logging in directly as the root, or administrator, account over SSH. Disabling direct root login and requiring a normal user plus sudo is one of the fastest ways to reduce the damage a single stolen credential can do.
Why direct root login is treated as a red flag
Root has no restrictions of any kind, so a single compromised session is equivalent to a full server takeover. Every automated brute-force script on the internet tries the username "root" first, since it is guaranteed to exist on almost every Linux server.
The usual alternative
Most hardened setups create a named administrative account, add it to the sudo group, and disable root login over SSH entirely. Anyone who needs root privileges still gets them through sudo, but only after authenticating as themselves first, leaving an audit trail of who ran what.
Frequently asked questions
Does disabling root login remove root access completely?
No. Root still exists and can be reached locally or through sudo from an authorized account; the only thing disabled is logging in directly as root from a remote SSH session.
Is it enough to just set a strong root password?
It reduces one risk but not the core problem, since a shared root login still gives no record of which person performed a given action. A named account with sudo is the safer default.
What Linux setting controls this?
The PermitRootLogin directive in sshd_config, usually set to "no" or "prohibit-password" on a hardened server.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab