How to Secure SSH — And Why It Should Be the First Thing You Do

When you spin up a new server — whether it's a VPS, a dedicated machine, or a cloud instance — the very first service exposed to the internet is almost always SSH (Secure Shell). It's your primary gateway for administration, file transfers, and remote management. And that makes it the number one target for attackers.

Automated bots scan the entire internet constantly, looking for SSH servers with weak passwords, default configurations, or outdated software. Within minutes of going online, your server will be probed. Within hours, it will be actively attacked.

This is why securing SSH should be the absolute first thing you do on any new server. In this guide, we'll walk through the essential steps to harden your SSH configuration and dramatically reduce your attack surface.

Why SSH Is the Primary Attack Vector

SSH is ubiquitous. Every Linux server, every VPS, and most cloud instances expose SSH on port 22 by default. Attackers know this, and they exploit it at scale using:

• Automated brute-force attacks — Bots try thousands of username and password combinations per minute against your server.
• Credential stuffing — Leaked credentials from other services are tested against your SSH server.
• Vulnerability scanning — Bots check for known exploits in older SSH versions.
• Dictionary attacks — Common passwords are attempted against default usernames like "root" or "admin".

If any of these succeed, the attacker gains shell access to your server — and from there, they can install malware, steal data, launch further attacks, or completely take over your system.

Step 1: Disable Root Login

The root account has unlimited privileges. If an attacker gains root access, they own your server completely. Disabling root login over SSH forces attackers to first compromise a regular user account, then attempt privilege escalation — a much harder task.

To disable root login:

1. Create a regular user with sudo privileges (if you haven't already):
   adduser myadmin
usermod -aG sudo myadmin
2. Edit the SSH configuration file:
   sudo nano /etc/ssh/sshd_config
3. Find the line PermitRootLogin and set it to:
   PermitRootLogin no
4. Restart SSH to apply changes:
   sudo systemctl restart sshd

Step 2: Use SSH Key Authentication Instead of Passwords

Password-based authentication is inherently vulnerable to brute-force and dictionary attacks. SSH key pairs use asymmetric cryptography — a private key on your local machine and a public key on the server. Without the private key, authentication is impossible, even if an attacker knows your username.

To set up key-based authentication:

1. Generate a key pair on your local machine (if you don't have one):
   ssh-keygen -t ed25519 -a 100
2. Copy the public key to your server:
   ssh-copy-id myadmin@your-server-ip
3. Test that key-based login works, then disable password authentication in /etc/ssh/sshd_config:
   PasswordAuthentication no
4. Restart SSH:
   sudo systemctl restart sshd

Step 3: Change the Default SSH Port

While not a security measure in itself (security through obscurity has limits), changing the default port 22 to a non-standard port (e.g., 2222 or 9922) will immediately eliminate 99% of automated bots that only scan default ports.

In /etc/ssh/sshd_config, change:
Port 2222

Then update your firewall rules and restart SSH. Remember to specify the new port when connecting:
ssh -p 2222 myadmin@your-server-ip

Step 4: Set Up a Firewall

Restrict SSH access to only the IP addresses that need it. If you have a static IP, you can whitelist it specifically. On Linux, use UFW (Uncomplicated Firewall) or iptables:

With UFW:

sudo ufw allow from YOUR_IP to any port 2222 proto tcp
sudo ufw deny 2222
sudo ufw enable

If you don't have a static IP, consider setting up a VPN (like WireGuard) and only allowing SSH through the VPN interface.

Step 5: Install Fail2ban

Fail2ban is an intrusion prevention tool that monitors authentication logs and temporarily bans IP addresses that show malicious behavior — like multiple failed SSH login attempts.

Install and configure Fail2ban for SSH:

sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Find the [sshd] section and ensure it's enabled:

[sshd]
enabled = true
port = ssh
maxretry = 3
bantime = 3600

This bans any IP that fails 3 login attempts within a 10-minute window for 1 hour.

Step 6: Keep SSH Updated

Vulnerabilities in SSH itself are rare, but they do happen. Always keep your SSH package updated:

sudo apt update
sudo apt upgrade openssh-server

Enable automatic security updates to ensure you never miss a critical patch:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Step 7: Additional Hardening (Optional)

For maximum security, consider these additional measures:

• Disable X11 forwarding — Set X11Forwarding no in sshd_config if you don't need graphical applications over SSH.
• Limit user access — Use AllowUsers or AllowGroups to restrict which accounts can SSH in.
• Set idle timeout — Add ClientAliveInterval 300 and ClientAliveCountMax 0 to automatically disconnect idle sessions after 5 minutes.
• Use a non-root user with sudo — Never log in as root directly. Use a regular user and elevate privileges with sudo only when needed.
• Enable two-factor authentication — For critical servers, add Google Authenticator or a similar TOTP solution alongside SSH keys.

Conclusion

SSH is the front door to your server, and leaving it unsecured is like leaving your house keys under the doormat. The steps outlined above — disabling root login, using key-based authentication, changing the default port, setting up a firewall, installing Fail2ban, and keeping software updated — form a defense-in-depth strategy that will protect your server from the vast majority of attacks.

The best time to secure SSH is the moment your server boots for the first time. Don't wait until you see the logs fill up with failed login attempts — by then, you're already at risk.

At NolimitHost, all our VPS and dedicated server plans come with the option of pre-configured firewall rules and SSH hardening. Our support team can also assist you with securing your server — just reach out to us on Discord.