Prevent Root Direct Login

[Trevor]

How can I configure my Linux system to prevent direct
SSH login, to any user account that has super user (roo)
privileges?

[rhnoname]

In the /etc/ssh/sshd_config, set PermissionRootLogin to no.

Then reload sshd service to apply the new configuration.

[Rajat_Pundir]

To prevent direct SSH login to user accounts with superuser (root) privileges:
1. Edit /etc/ssh/sshd_config:
    - PermitRootLogin no
    - DenyUsers root (or DenyGroups wheel)
2. Restart SSH service: sudo systemctl restart sshd

[Tracy_Baker]

You said any user with superuser privileges?

So you want a user, like bob, to not be able to log into system01 if bob can use the sudo and/or su commands on system01?

-----

I don't think you can do this - at least not from what your question implies. From what I can determine, preventing a user with superuser privileges  from being able to log in using SSH requires that you know the user's name. If known, they can be added to the /etc/ssh/sshd_config file using the DenyUsers key:

DenyUsers bob jane joe tracy

The root user can be specifically denied by doing:

PermitRootLogin no

Then reload the SSH daemon: systemctl reload-or-restart sshd.service

-----

However, neither approach works with users that have superuser privileges whose name(s) is/are unknown.

[Trevor]

You caught that - "any user"!!!

[Tracy_Baker]

I teach my students to pay attention to the details, the least I can do is the same.

[abhidd]

1. Use SSH Key-Based Authentication Only:

You can restrict SSH access by requiring SSH keys for authentication and disabling password-based authentication altogether.

1. In /etc/ssh/sshd_config, find and set: PasswordAuthentication no
2. Restart the SSH service again:

This will enforce SSH key-based logins and prevent any password-based logins (including for users with sudo privileges).

    2. Disable Root Login via SSH:

Open the SSH configuration file (/etc/ssh/sshd_config) using a text editor like vi or nano:

Look for the PermitRootLogin directive. If it is not present, add the following line:

PermitRootLogin no

• This will completely disable root login via SSH.

• Save the file and exit the editor.

• To apply the changes, restart the SSH service: sudo systemctl restart sshd

    3. Alternatively, you create a rule in /etc/ssh/sshd_config to deny login to users with superuser privileges:

[Gopinath_Pigili]

Open the file “/etc/ssh/sshd_config” in any of your favorite text editors.
Find the section in the file containing the line with “#PermitRootLogin yes” in it.
Uncomment and change it to “PermitRootLogin no”.
Save the file and exit.
Restart the sshd service.

Thanks