How to secure an SSH server on Linux
Replace password authentication with SSH keys and disable PasswordAuthentication. 2. Change default SSH port to reduce automated attacks. 3. Limit user access, disable root login, and set connection limits. 4. Install and configure Fail2Ban to block brute-force attempts. Proper permissions and testing are critical.
To secure an SSH server on Linux, focus on minimizing attack surface and strengthening authentication. The default SSH setup is functional but often exposed to brute-force attacks and misconfigurations. Applying key hardening steps significantly improves security.
Use Key-Based Authentication
Replace password login with SSH keys for stronger access control. Passwords can be guessed or cracked, but private keys are much harder to compromise.
- Generate a key pair using ssh-keygen on the client machine
- Copy the public key to the server's ~/.ssh/authorized_keys file
- Set correct permissions: chmod 700 ~/.ssh and chmod 600 ~/.ssh/authorized_keys
- Disable password authentication in /etc/ssh/sshd_config by setting PasswordAuthentication no
Change Default SSH Port
Running SSH on port 22 makes it a prime target for automated bots. Changing the port reduces noise from constant scan attempts.
- Edit /etc/ssh/sshd_config and set Port 2222 (or another non-standard port)
- Update firewall rules to allow the new port
- Restart SSH: sudo systemctl restart sshd
- Test connection before closing current session
Limit User Access and Connections
Restrict who can log in and how they connect to reduce risk of unauthorized access.
- Allow only specific users with AllowUsers alice bob in sshd_config
- Disable root login by setting PermitRootLogin no
- Use MaxAuthTries to limit failed attempts per session
- Set LoginGraceTime to close inactive login prompts
Enable Fail2Ban for Brute-Force Protection
Fail2Ban monitors logs and blocks IPs showing malicious behavior, like repeated failed logins.
- Install Fail2Ban: sudo apt install fail2ban (Debian/Ubuntu) or use your distro’s package manager
- Copy jail.conf to jail.local to preserve custom settings
- Enable SSH protection by setting sshd.enabled = true
- Tune ban time and retry limits based on your environment
The above is the detailed content of How to secure an SSH server on Linux. For more information, please follow other related articles on the PHP Chinese website!
Hot AI Tools
Undress AI Tool
Undress images for free
AI Clothes Remover
Online AI tool for removing clothes from photos.
Undresser.AI Undress
AI-powered app for creating realistic nude photos
ArtGPT
AI image generator for creative art from text prompts.
Stock Market GPT
AI powered investment research for smarter decisions
Hot Article
Popular tool
Notepad++7.3.1
Easy-to-use and free code editor
SublimeText3 Chinese version
Chinese version, very easy to use
Zend Studio 13.0.1
Powerful PHP integrated development environment
Dreamweaver CS6
Visual web development tools
SublimeText3 Mac version
God-level code editing software (SublimeText3)
Hot Topics
20518
7
13631
4
How to manage software packages using Dnf and Rpm in Linux?
Mar 07, 2026 am 01:50 AM
dnfinstall prompts packagenotfound because it queries the enabled warehouse rather than the local installation status; rpm-q queries the local RPM database, and the scopes of the two are different.
How to monitor system performance and resources in Linux? (Top & Htop)
Mar 06, 2026 am 01:04 AM
The total top CPU usage is not 100% because it is calculated based on a single core, and the maximum is 800% for an 8-core system; the htop terminal size error needs to be fixed with eval$(resize); the real memory pressure is available rather than used; top command line truncation can be solved with the -c parameter.
How to setup file sharing using Samba on Linux? (SMB Protocol)
Mar 13, 2026 am 12:33 AM
The main reason why Windows cannot see the Samba share is that the firewall blocks UDP137–139/TCP445 or NetBIOS name resolution fails; it is necessary to confirm that the workgroup is consistent, the interfaces are configured correctly, the file permissions match forceuser/forcegroup, and set doscharset=UTF-8 to solve Chinese garbled characters.
How to extend a Logical Volume (LVM) in Linux without downtime?
Mar 13, 2026 am 12:53 AM
Logical volumes and file systems can be expanded online. You need to expand the LV first and then the file system. It is recommended to use lvextend-r for automatic synchronization adjustment, but you must ensure that the LVM and file system tool versions are compatible.
How to check open ports and listening services in Linux? (Netstat & SS)
Mar 10, 2026 am 01:08 AM
Netstat displays fewer LISTEN ports than ss because it does not display process information by default that non-root users do not have access to; ss can read all listening sockets by default without process names, and sudonetstat-tulpn is required to display them completely.
How to set up SSH key authentication on Linux? (Passwordless Login)
Mar 11, 2026 am 12:46 AM
It is recommended to use ssh-keygen-ted25519 to generate a key pair, because it is faster, more secure, and has a shorter key than the default RSA; it is necessary to strictly set the ~/.ssh directory permissions to 700 and authorized_keys to 600, and use ssh-v to confirm whether the client is Offering public key and whether the server rejects it.
How to format disk partitions using the command line in Linux?
Mar 15, 2026 am 12:01 AM
When fdisk is stuck at the Command prompt, it is normally waiting for input. Enter q to exit safely; you must umount before mkfs, otherwise it may fail silently; partedmkpart does not support the specified file system type, and mkfs needs to be executed separately.
How to configure a static IP address on Linux? (Netplan & NetworkManager)
Mar 14, 2026 am 12:02 AM
Netplan reports "InvalidYAML" when configuring a static IP due to indentation errors, missing spaces after colons, or mixed tabs; gateway4 has been deprecated and routes to:default must be used instead; NetworkManager needs to be modified before down/up takes effect; the renderer field is used to determine the backend during coexistence; incorrect DNS configuration will cause ping to succeed but curl to fail.
