---
title: "HOST-SSH-001 SSH Allows Direct Root Login"
canonical: https://openvapt.com/checks/HOST-SSH-001.html
html: https://openvapt.com/checks/HOST-SSH-001.html
site: OpenVAPT, https://openvapt.com/
license: OpenVAPT Source-Available Licence 1.3, https://openvapt.com/legal/licence-text.html
modified: 2026-10-14
version: 0.1.0-alpha.6
---

# HOST-SSH-001 SSH Allows Direct Root Login

Checks whether the SSH daemon accepts logins as root with a password.

- Domain: Server
- Severity: High
- Control category: Identity and Authentication
- Fix effort: low
- CVSS v3.1 vector: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
- CIS Controls v8: 5.4
- NIST CSF 2.0: PR.AA-05
- CWE: CWE-250
- NIST SP 800-53 Rev. 5: AC-6(2), IA-2
- Benchmark topic: SSH server configuration: root login (topic only, no benchmark text)

## Why It Matters

Root is the one account name every attacker knows. Allowing it over SSH turns any password guess into full control of the server, and removes the audit trail of which person used root.

## How It Detects

Reads the effective sshd configuration (sshd -T, or the config files as a fallback) and inspects PermitRootLogin. The value 'yes' fails. When the keyword is absent from the files (sshd -T always prints it), the installed OpenSSH version decides: 7.0 and later default to prohibit-password and pass with that noted; older versions defaulted to yes and fail; an unknown version is Incomplete, because the effective value needs sshd -T as root. 'prohibit-password', 'without-password', 'forced-commands-only' and 'no' pass. A risky value set inside a Match block in the config files fails as a conditional finding, with the Match condition in the evidence.

## How to Fix

In /etc/ssh/sshd_config set:  PermitRootLogin no  (or prohibit-password if key-based root login is truly required). Log in as a named user and use sudo. Then run: sshd -t && systemctl reload sshd

## How to Verify

```
sshd -T | grep -i permitrootlogin  should print 'permitrootlogin no'.
```

## Learn the Theory

- [P2 SSH Security](https://openvapt.com/academy/p2.md)
- [P15 Access Control: Accounts, Sudo and Logins](https://openvapt.com/academy/p15.md)
- [P23 Test Design for Security Checks](https://openvapt.com/academy/p23.md)
- [A2 Remediation and Verification](https://openvapt.com/academy/a2.md)

## References

- [OpenBSD, sshd_config(5) manual page](https://man.openbsd.org/sshd_config)
- [NIST SP 800-123, Guide to General Server Security](https://csrc.nist.gov/pubs/sp/800/123/final)

## Source Code

https://github.com/OpenVAPT/openvapt/blob/574f7f3333c44b75a3c649e2d93a76d507f75adf/internal/checks/host/ssh_root_login.go

Run it: `openvapt scan --only HOST-SSH-001`. Read it offline: `openvapt explain HOST-SSH-001`.

---

OpenVAPT is academic, non-commercial, source-available and built by AI Cybersecurity Engineers (AI systems, not people). Free for your own use on machines you own or control, 100% at your own risk; not for sale and not for providing services. This page in HTML: https://openvapt.com/checks/HOST-SSH-001.html. Part of OpenVAPT Check Catalogue. How to cite: https://openvapt.com/cite.html. Site summary for models: https://openvapt.com/llms.txt.