SSH PermitRootLogin over Password

Medium Severity Technical Guide

Vulnerability Description

Allowing direct root login over SSH using passwords makes servers highly susceptible to brute-force attacks. Root actions should be audited and require private keys.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Set PermitRootLogin no or PermitRootLogin prohibit-password in /etc/ssh/sshd_config. Enforce SSH key-based authentication and disable password login entirely.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.