I mean not just using "PermitRootLogin no". If not, how can it be achieved with minimal effort and without impacting access for other users, both local and remote, who may have the credentials to log in as root via SSH if they have logged in as regular users? The "PermitRootLogin no" setting is already in place.

I also don't want to create new users or groups, or apply group restrictions. What other options are available besides these?

I found these online, but they could disrupt normal operation if the user or others are locally on the machine.

sudo configuration: "/etc/sudoers":
username ALL=(ALL:ALL) ALL, !/bin/su, !/usr/bin/sudo -u root

su configuration in pam: "/etc/pam.d/su":
auth required pam_wheel.so use_uid

login configuration in pam: "/etc/pam.d/login":
auth required pam_wheel.so use_uid

I simply want to prevent root login after a user has logged in normally. However, if they are physically present on the machine, they should be able to log in as root after logging in with their own account.

Is there a setting in "sshd_config" or a very simple solution for this, without the given requirements above?

I mean not just using PermitRootLogin no. If not, how can it be achieved with minimal effort and without impacting access for other users, both local and remote, who may have the credentials to log in as root via SSH if they have logged in as regular users? The PermitRootLogin no setting is already in place.

I also don't want to create new users or groups, or apply group restrictions. What other options are available besides these?

I found these online, but they could disrupt normal operation if the user or others are locally on the machine.

sudo configuration: "/etc/sudoers":
username ALL=(ALL:ALL) ALL, !/bin/su, !/usr/bin/sudo -u root

su configuration in pam: "/etc/pam.d/su":
auth required pam_wheel.so use_uid

login configuration in pam: "/etc/pam.d/login":
auth required pam_wheel.so use_uid

I simply want to prevent root login after a user has logged in normally. However, if they are physically present on the machine, they should be able to log in as root after logging in with their own account.

Is there a setting in sshd_config or a very simple solution for this, without the given requirements above?

I mean not just using "PermitRootLogin no". If not, how can it be achieved with minimal effort and without impacting access for other users, both local and remote, who may have the credentials to log in as root via SSH if they have logged in as regular users? The "PermitRootLogin no" setting is already in place.

I also don't want to create new users or groups, or apply group restrictions. What other options are available besides these?

I found these online, but they could disrupt normal operation if the user or others are locally on the machine.

sudo configuration: "/etc/sudoers": username ALL=(ALL:ALL) ALL, !/bin/su, !/usr/bin/sudo -u root

su configuration in pam: "/etc/pam.d/su": auth required pam_wheel.so use_uid

login configuration in pam: "/etc/pam.d/login": auth required pam_wheel.so use_uid

I simply want to prevent root login after a user has logged in normally. However, if they are physically present on the machine, they should be able to log in as root after logging in with their own account.

Is there a setting in "sshd_config" or a very simple solution for this, without the given requirements above?

Thank you

I mean not just using "PermitRootLogin no". If not, how can it be achieved with minimal effort and without impacting access for other users, both local and remote, who may have the credentials to log in as root via SSH if they have logged in as regular users? The "PermitRootLogin no" setting is already in place.

I also don't want to create new users or groups, or apply group restrictions. What other options are available besides these?

I found these online, but they could disrupt normal operation if the user or others are locally on the machine.

sudo configuration: "/etc/sudoers": 
username ALL=(ALL:ALL) ALL, !/bin/su, !/usr/bin/sudo -u root

su configuration in pam: "/etc/pam.d/su": 
auth required pam_wheel.so use_uid

login configuration in pam: "/etc/pam.d/login": 
auth required pam_wheel.so use_uid

I simply want to prevent root login after a user has logged in normally. However, if they are physically present on the machine, they should be able to log in as root after logging in with their own account.

Is there a setting in "sshd_config" or a very simple solution for this, without the given requirements above?