5 ways to lock down your SSH server

Spin up a new Linux server, leave port 22 open, and check your logs an hour later. Automated scripts will already be trying to guess your root password.

You can fix most of this in about ten minutes.

1. Turn off password logins

Passwords are a liability. People reuse them, and scripts can brute-force them. SSH keys fix the problem entirely.

Open your SSH config file:

sudo nano /etc/ssh/sshd_config

Change PasswordAuthentication to no:

PasswordAuthentication no

Restart the service:

sudo systemctl restart sshd

2. Change the default port

Moving SSH off port 22 doesn't secure your server against a targeted attack, but it drops the background noise from random automated scanners down to zero.

In /etc/ssh/sshd_config, change the port:

Port 2222

Make sure to open port 2222 in your firewall before restarting SSH, or you will lock yourself out.

3. Switch to Ed25519 keys

If you are still generating RSA keys out of habit, you can stop. Ed25519 is faster and the keys are much shorter.

Generate a new pair locally:

ssh-keygen -t ed25519 -C "your_email@example.com"

4. Install Fail2Ban

Fail2Ban just sits in the background watching your system logs. If an IP fails to log in too many times, it adds a temporary firewall rule to ban them.

On Ubuntu or Debian:

sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

5. Block root logins

Logging in directly as root is a bad habit. Use a standard user account and type sudo when you actually need it.

In /etc/ssh/sshd_config:

PermitRootLogin no

---

That covers the basics. If you need a way to manage your servers from a browser without syncing keys across every device you own, SSHDock handles this securely.