How to Enable Remote Root SSH Access on Ubuntu and Change the Root Password

On Ubuntu, root password login is closed by default. Sometimes you still need it — for an old control panel, a script or a contractor. Here is how to open access properly, change the password and avoid becoming an easy brute-force target.

Why root SSH login is closed

Ubuntu has two safeguards at once. First, root often has no password: the account is locked and administration is meant to go through sudo. Second, OpenSSH defaults to PermitRootLogin prohibit-password: root can log in with an SSH key only, not with a password. Cloud images also ship /etc/ssh/sshd_config.d/50-cloud-init.conf, which often disables password login for everyone.

So the order is: set a root password, allow the login in the SSH settings, then check that the setting really took effect.

Step 1. Set or change the root password

Log in as a user with sudo rights (or through the console in your client area) and run:

sudo passwd root

Enter the new password twice — nothing is shown on screen, that is normal. If you are already working as root, passwd is enough. Another user’s password is changed the same way: sudo passwd USERNAME.

Check the account status:

sudo passwd -S root

In the second field, P means a usable password is set, L means the account is locked, NP means there is no password.

What password to use. A root account exposed to the internet gets brute-forced within hours of the server going live. Use a long random password — at least 16 characters, not a dictionary word and not reused from another service. You can generate one right on the server:

openssl rand -base64 18

Step 2. Allow root to log in over SSH

Don’t edit the main sshd_config — create a separate settings file. On Ubuntu 22.04 and 24.04, files in /etc/ssh/sshd_config.d/ are read in alphabetical order and the first value found wins. That is why the file name starts with 01 — it is read before 50-cloud-init.conf:

sudo nano /etc/ssh/sshd_config.d/01-root-login.conf

Add two lines and save the file (Ctrl+O, Enter, Ctrl+X):

PermitRootLogin yes
PasswordAuthentication yes

If root will only log in with a key, you don’t need to open password login at all: keep PermitRootLogin prohibit-password and put the key into /root/.ssh/authorized_keys — see the article on SSH keys.

Step 3. Check and apply the settings

First make sure the configuration has no errors and see which values sshd will actually use:

sudo sshd -t
sudo sshd -T | grep -Ei "permitrootlogin|passwordauthentication"

You should see permitrootlogin yes and passwordauthentication yes. If not, another file with the opposite value is read before yours — find it with sudo grep -ri "PermitRootLogin\|PasswordAuthentication" /etc/ssh/.

Restart SSH:

sudo systemctl restart ssh

If the UFW firewall is enabled, make sure SSH is allowed: sudo ufw status, and if needed sudo ufw allow OpenSSH.

Step 4. Test the login

Don’t close your current session. Open a new window and connect:

ssh root@YOUR_IP

On Windows the same command works in PowerShell; in PuTTY enter the IP, port 22 and the login root. If the login fails, check the reason in the log from the first window: sudo journalctl -u ssh -n 30.

How to protect root once access is open

• Switch to a key. As soon as only you need root access, set up SSH key login and change the lines in 01-root-login.conf to PermitRootLogin prohibit-password and PasswordAuthentication no.
• Restrict access by IP. If you connect from a fixed address, allow SSH only from it: sudo ufw allow from 203.0.113.10 to any port 22 proto tcp, and remove the general rule: sudo ufw delete allow OpenSSH. Do this from a session that is already connected, and only when you are sure of your IP.
• Install fail2ban. sudo apt install fail2ban — on Ubuntu it protects SSH out of the box and bans addresses after several failed attempts.
• Close root when you no longer need it. Delete the file and restart SSH: sudo rm /etc/ssh/sshd_config.d/01-root-login.conf && sudo systemctl restart ssh. The root password itself can be locked with sudo passwd -l root.

If you forgot the root password

If there is another user with sudo, log in as that user and run sudo passwd root. If nobody can log in, on a MyCloud VPS open the server console in your mcvps.uz account and reboot the server. In the GRUB menu (hold Shift or press Esc during boot) choose “Advanced options” → “recovery mode” → “root”. Then run:

mount -o remount,rw /
passwd root
reboot

You can create an Ubuntu server on the VPS servers page — the console in your client area stays as a fallback even if something goes wrong with the SSH settings.