The PermitRootLogin parameter specifies if the root user can log in using ssh(1). The default is no.
Rationale
Disallowing root logins over SSH requires server admins to authenticate using their own individual account, then escalating to root via sudo or su. This in turn limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident.
Audit Procedure
Using Command Line
To verify the correct SSH setting, run the following command and verify that the output is as shown:
grep "^PermitRootLogin" /etc/ssh/sshd_config
Expected Result
PermitRootLogin no
Remediation
Using Command Line
Edit the /etc/ssh/sshd_config file to set the parameter as follows:
PermitRootLogin no
Default Value
PermitRootLogin no
References
CIS Ubuntu 12.04 LTS Server Benchmark v1.1.0
Profile
Level 1 - Scored
1---2name: cis-ubuntu1204-v110-9-3-83description: Disable SSH Root Login4---56# 9.3.8 Disable SSH Root Login (Scored)78## Profile Applicability910- Level 11112## Description1314The `PermitRootLogin` parameter specifies if the root user can log in using ssh(1). The default is no.1516## Rationale1718Disallowing root logins over SSH requires server admins to authenticate using their own individual account, then escalating to root via `sudo` or `su`. This in turn limits opportunity for non-repudiation and provides a clear audit trail in the event of a security incident.1920## Audit Procedure2122### Using Command Line2324To verify the correct SSH setting, run the following command and verify that the output is as shown:2526```bash27grep "^PermitRootLogin" /etc/ssh/sshd_config28```2930## Expected Result3132```33PermitRootLogin no34```3536## Remediation3738### Using Command Line3940Edit the `/etc/ssh/sshd_config` file to set the parameter as follows:4142```bash43PermitRootLogin no44```4546## Default Value4748PermitRootLogin no4950## References5152- CIS Ubuntu 12.04 LTS Server Benchmark v1.1.05354## Profile5556Level 1 - Scored
Run npx skillmds@latest add cyberstrikeus/cis-ubuntu1204-v110-9-3-8 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Disable SSH Root Login It is listed under Coding & Dev Tools on SkillMD.
SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.
cyberstrikeus