> ## Content Index
> Fetch the complete content index at: https://trendboxgeek.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to Disable SSH Root Login on a Debian 13 Server
- URL: https://trendboxgeek.com/blog/disable-ssh-root-debian-13/
- Published: 2026-08-14T11:02:15.000Z
- Updated: 2026-08-14T11:02:15.000Z
- Author: Pankajbhai Chavda
- Tags: #blog-col

If you have just spun up a fresh Debian 13 server for your business or homelab, the first thing you need to do is cut off direct root access over SSH. 

Leaving root login enabled is a massive security gap. It means automated scanners hitting port 22 already know half of your login credentials, so they only have to brute-force the password. Disabling root login forces them to guess both, which kills almost all automated attacks dead in their tracks. 

It takes only two minutes to fix, but you have to do it in the right order. If you cut off root before verifying your standard user, you will permanently lock yourself out of your own server. 

Here is the exact workflow for how to lock down root access on Debian 13.

## The "Don't Lock Yourself Out" Pre-Check

Before you touch any configuration files, make sure your standard user account actually has admin rights. If you disable root login without a backup admin user, you will be permanently locked out of your server via SSH.

Log into your server with your standard user and run the command below.

sudo whoami

If the terminal shows you `root`, then everything is good. If it gives you an error about not being in the sudoers file, stop right here and first give your user sudo permission.

## Edit the SSH Config

Debian manages its main SSH daemon configuration in `/etc/ssh/sshd_config`. Open this file using your favorite text editor. We'll use nano here:

sudo nano /etc/ssh/sshd_config

In this config file, scroll down until you find the `PermitRootLogin` line. On a default Debian 13 install, it looks like:

`#PermitRootLogin prohibit-password`

Delete the `#` to uncomment the line and change the value to **no**.

`PermitRootLogin no`

### The prohibit-password Alternative:

If you use tools like Kopia or Proxmox Backup Server that require direct root access to pull files, setting this to `no` will break them. In this case, use `PermitRootLogin prohibit-password` instead.

This blocks password login, but you can still log in as root using SSH keys. For a standard homelab server though, `no` is what you want.

## Restart SSH

Save the file using Ctrl+O, Enter, then Ctrl+X. Apply the changes by restarting the SSH service.

sudo systemctl restart ssh

## The Live Test

Do not close your current terminal window. If you made a typo and locked yourself out, this active session is your only way to fix it.

Open a completely new terminal window on your computer and try logging in as root.

ssh root@your_server_ip

**Expected Output:**

![block root login in debian 13.](https://trendboxgeek.com/content/images/2026/08/Screenshot-From-2026-08-14-11-55-49.png)

It will still prompt you for a password, but no matter what you type, it will reject you with a 'Permission denied' error like the screenshot.

Finally, try logging in with your standard user in that new window. If you get in successfully, the job is done. You can safely close your original root session.