How to Secure Your SSH Server on Linux? (Best Practices Guide)

SSH security hardening needs to focus on four aspects: authentication, access control, encryption, and monitoring: enable key authentication, disable password login, restrict users/IPs and modify default ports, configure strong encryption algorithms and protocol v2, and combine fail2ban and log monitoring to defend against attacks.

Lock down your SSH server by focusing on access control, encryption hardening, and proactive monitoring—most breaches happen through weak credentials or outdated configurations.

Use Key-Based Authentication Instead of Passwords

Password logins are vulnerable to brute-force attacks. Switch to SSH key pairs for stronger, phishing-resistant access.

• Generate a key pair on your local machine with ssh-keygen -t ed25519 (prefer Ed25519 over RSA if supported)
• Copy the public key to the server using ssh-copy-id user@server —never manually edit authorized_keys unless necessary
• Disable password authentication in /etc/ssh/sshd_config : set PasswordAuthentication no and ChallengeResponseAuthentication no
• Restart SSH: sudo systemctl restart sshd (or sshd on older systems)

Restrict Access and Reduce Attack Surface

Limit who can connect—and how—to minimize exposure.

• Change the default SSH port (eg, from 22 to something like 2222) in sshd_config —not a substitute for real security, but reduces noise from automated scanners
• Allow only specific users or groups: use AllowUsers alice bob or AllowGroups sshusers
• Bind SSH to specific IPs if possible: ListenAddress 192.168.1.10 (or your management interface)
• Disable root login entirely: set PermitRootLogin no

Harden Encryption and Protocol Settings

Older ciphers and protocols introduce known vulnerabilities—modernize your config.

• Disable SSH protocol v1: ensure Protocol 2 is set (v1 is obsolete and insecure)
• Explicitly define strong ciphers and KEX algorithms—add these lines to sshd_config :
• Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
• KexAlgorithms curve25519-sha256,ecdh-sha2-nistp521,diffie-hellman-group16-sha384
• MACs hmac-sha2-512-etm@openssh.com, hmac-sha2-256-etm@openssh.com

Monitor, Limit, and Automate Defense

Detect and block suspicious activity before it escalates.

• Install and configure fail2ban to auto-block repeated failed login attempts
• Keep logs readable and rotated: verify /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) is active and monitored
• Set login grace time and idle timeouts: add LoginGraceTime 60 and ClientAliveInterval 300 ClientAliveCountMax 0
• Use ufw or firewalld to restrict SSH access by IP range if feasible (eg, sudo ufw allow from 203.0.113.5 to any port 22 )

Basically just these four areas—authentication, access, crypto, and monitoring—cover most real-world SSH risks. It's not complex, but skipping even one step leaves room for exploitation.

The above is the detailed content of How to Secure Your SSH Server on Linux? (Best Practices Guide). For more information, please follow other related articles on the PHP Chinese website!