Enable and Disable the Root Account in Ubuntu: Full Guide

Ubuntu locks the root account by default. New users often wonder what the root password is or how to log in as root. No password is set, and that is intentional.

This guide covers how to access root temporarily without enabling the account, how to enable root on Ubuntu when you genuinely need it, how to configure SSH root login, and how to lock the account again when you are done.

Ubuntu Root Account: Why It’s Disabled and Temporary Alternatives

Ubuntu uses the sudo model instead of direct root logins. Every command run with sudo is logged, and each requires deliberate intent. A persistent root session gives every command elevated privileges by default — there is no check between you and full system access. Members of the sudo group get administrative access. The first user created during installation is already a member.

To add another user to the sudo group:

bashsudo usermod -aG sudo username

For most administrative work, you do not need to enable the root account. Ubuntu provides three ways to open a root shell temporarily:

• sudo -i – opens a full root login shell with root’s HOME directory, PATH, and environment. Type exit when done. This is the recommended approach for multi-command admin tasks
• sudo su – chains sudo and su together. You get root’s environment without needing the root password directly
• sudo -s – opens a root shell but keeps your current user’s environment variables. Root’s HOME is not loaded, so paths and config files may differ from a full login shell

All three give root access without permanently enabling the account, which is the safer practice for routine administration.

Enable Root on Ubuntu: Set a Password and Use SSH Key Login

To enable the root account, set a password for it:

bashsudo passwd root

Enter and confirm the new password when prompted. Switch to the root account with su -:

bashsu -

The - flag gives you a full login shell with root’s HOME and environment. Without it, some of root’s environment variables are not loaded, and paths may not work as expected.

SSH root login is not enabled automatically. Setting a root password does not allow SSH access as root. Ubuntu’s default PermitRootLogin value is prohibit-password, which allows SSH key logins but blocks password authentication for root.

Before editing /etc/ssh/sshd_config, check the configuration snippets in /etc/ssh/sshd_config.d/. These files are read first, and for most SSH options the first value found takes precedence. Editing sshd_config may have no effect if a snippet already sets the option. Check the effective value:

bashsudo sshd -T | grep permitrootlogin

To allow root password logins, set PermitRootLogin yes in the appropriate file. Validate before restarting — a syntax error makes SSH unreachable on a remote server:

bashsudo sshd -tsudo systemctl restart ssh

Security warning: Root password logins over SSH make the account a direct target for brute-force attacks. Use SSH key authentication for root instead, or log in as a regular user and use sudo. Keep your current SSH session open until you confirm the new connection works.

Disable the Root Account and Lock Down SSH Root Access

To lock the root password:

bashsudo passwd -l root

The -l flag adds an ! prefix to the encrypted password entry in /etc/shadow. Password authentication for root stops working, but the account still exists. Root can still log in via an authorized SSH key. To block all root SSH access, set PermitRootLogin no, validate with sudo sshd -t, and restart SSH.

To return root to Ubuntu’s default state — no password set, account locked:

bashsudo passwd -dl root

The -d flag removes the stored password. The -l flag locks the account. Together they match Ubuntu’s factory default. This command does not remove SSH keys from /root/.ssh/authorized_keys. If root had key-based SSH access configured, remove those keys separately.

To unlock the root account without setting a new password:

bashsudo passwd -u root

Use sudo -i for routine administrative tasks — it keeps the root account locked while giving you a full root shell. If you enabled root for a specific task, run sudo passwd -dl root when done to restore Ubuntu’s defaults. Leave a comment below if you run into any issues.