If you have just spun up a fresh Debian 13 server for your business or homelab, the first thing you need to do is cut off direct root access over SSH.
Leaving root login enabled is a massive security gap. It means automated scanners hitting port 22 already know half of your login credentials, so they only have to brute-force the password. Disabling root login forces them to guess both, which kills almost all automated attacks dead in their tracks.
It takes only two minutes to fix, but you have to do it in the right order. If you cut off root before verifying your standard user, you will permanently lock yourself out of your own server.
Here is the exact workflow for how to lock down root access on Debian 13.
The "Don't Lock Yourself Out" Pre-Check
Before you touch any configuration files, make sure your standard user account actually has admin rights. If you disable root login without a backup admin user, you will be permanently locked out of your server via SSH.
Log into your server with your standard user and run the command below.
sudo whoami
If the terminal shows you root, then everything is good. If it gives you an error about not being in the sudoers file, stop right here and first give your user sudo permission.
Edit the SSH Config
Debian manages its main SSH daemon configuration in /etc/ssh/sshd_config. Open this file using your favorite text editor. We'll use nano here:
sudo nano /etc/ssh/sshd_config
In this config file, scroll down until you find the PermitRootLogin line. On a default Debian 13 install, it looks like:
#PermitRootLogin prohibit-password
Delete the # to uncomment the line and change the value to no.
PermitRootLogin no
The prohibit-password Alternative:
If you use tools like Kopia or Proxmox Backup Server that require direct root access to pull files, setting this to no will break them. In this case, use PermitRootLogin prohibit-password instead.
This blocks password login, but you can still log in as root using SSH keys. For a standard homelab server though, no is what you want.
Restart SSH
Save the file using Ctrl+O, Enter, then Ctrl+X. Apply the changes by restarting the SSH service.
sudo systemctl restart ssh
The Live Test
Do not close your current terminal window. If you made a typo and locked yourself out, this active session is your only way to fix it.
Open a completely new terminal window on your computer and try logging in as root.
ssh root@your_server_ip
Expected Output:
It will still prompt you for a password, but no matter what you type, it will reject you with a 'Permission denied' error like the screenshot.
Finally, try logging in with your standard user in that new window. If you get in successfully, the job is done. You can safely close your original root session.
