How to Enable Root Login (if disabled)

Prerequisites

Before enabling root login, make sure you have:

• SSH access to your VPS with a sudo user
• Your server IP address
• Sudo user password

Step 1: Connect to Your VPS with Sudo User

ssh username@YOUR_SERVER_IP -p 22

Step 2: Edit SSH Configuration

Open the SSH daemon config file:

sudo nano /etc/ssh/sshd_config

Step 3: Find and Change PermitRootLogin

Look for this line:

PermitRootLogin no

Change it to:

PermitRootLogin yes

If the line doesn't exist, add it:

PermitRootLogin yes

Other options you can use:

• PermitRootLogin yes - Allow root login with password (least secure)
• PermitRootLogin prohibit-password - Allow root only with SSH keys
• PermitRootLogin forced-commands-only - Only for specific commands

Step 4: Restart SSH Service

sudo systemctl restart sshd

For older systems:

sudo service ssh restart

Step 5: Test Root Login

Open a new terminal window and try:

ssh hxroot@YOUR_SERVER_IP -p 22

Enter the root password when prompted.

Alternative Method: Temporary Root Access via Sudo

If you only need root temporarily, don't enable root login. Instead:

ssh username@YOUR_SERVER_IP

sudo -i

This gives you a root shell without enabling root SSH login.

Enable Root Login with SSH Key Only (More Secure)

This method allows root login but only with an SSH key, not password:

sudo nano /etc/ssh/sshd_config

Set:

PermitRootLogin prohibit-password

Then restart SSH:

sudo systemctl restart sshd

Now copy your SSH key to root:

sudo ssh-copy-id hxroot@YOUR_SERVER_IP

Check Current Root Login Status

sudo grep PermitRootLogin /etc/ssh/sshd_config

Disable Root Login Again (Reversing Changes)

sudo nano /etc/ssh/sshd_config

Change back to:

PermitRootLogin no

sudo systemctl restart sshd

Why Root Login is Disabled by Default

• Brute force attacks target root user
• Root has unlimited system access
• No audit trail (sudo commands are logged)
• Accidental mistakes as root can break server
• Industry security best practice

Best Practices Instead of Root Login

1. Use a sudo user for daily tasks
2. Use SSH keys instead of passwords
3. Change SSH port from 22 to a custom port
4. Set up Fail2ban to block failed attempts
5. Use 2FA for SSH