SSH Hardening on Linux — 7 Steps to Lock Down Remote Access

SSH Hardening on Linux

The default SSH configuration on most Linux servers is functional but not secure. Bots and automated scanners probe port 22 constantly. These 7 steps significantly reduce your attack surface.

---

Step 1 — Generate an SSH Key Pair (On Your Local Machine)

Before hardening, set up key-based auth so you don't lock yourself out when you disable password login.

On your local machine:

ssh-keygen -t ed25519 -C "your-label"
Copy

This creates two files in ~/.ssh/:

• id_ed25519 — private key (keep this safe, never share it)
• id_ed25519.pub — public key (this goes on the server)

---

Step 2 — Copy Your Public Key to the Server

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@your-server-ip
Copy

Or manually append it to the server's ~/.ssh/authorized_keys:

cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
Copy

Test that key-based login works before disabling password auth:

ssh -i ~/.ssh/id_ed25519 user@your-server-ip
Copy

---

Step 3 — Edit the SSH Config File

Open the SSH daemon config on the server:

sudo nano /etc/ssh/sshd_config
Copy

---

Step 4 — Disable Root Login

Find and set:

PermitRootLogin no
Copy

Root is the most targeted account. Never allow direct root SSH access.

---

Step 5 — Disable Password Authentication

Once key-based auth works, disable passwords entirely:

PasswordAuthentication no
ChallengeResponseAuthentication no
Copy

This makes brute-force attacks impossible — there's no password to guess.

---

Step 6 — Change the Default Port

Change from port 22 to something less targeted:

Port 2222
Copy

This won't stop determined attackers but eliminates noise from mass scanners targeting port 22.

Important: Also update your firewall:

sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp
Copy

---

Step 7 — Restrict Login to Specific Users

Limit SSH access to specific usernames:

AllowUsers yourusername
Copy

Or restrict to a specific group:

AllowGroups sshusers
Copy

---

Apply the Changes

After editing sshd_config, reload SSH:

sudo systemctl reload sshd
Copy

Test the new connection in a new terminal window before closing your current session.

---

Bonus: Fail2Ban (Auto-Block Attackers)

Install Fail2Ban to automatically ban IPs that fail login attempts:

sudo apt install fail2ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
Copy

Check its status:

sudo fail2ban-client status sshd
Copy

---

Hardening Checklist

Step	Setting	Value
Root login	PermitRootLogin	no
Password auth	PasswordAuthentication	no
Default port	Port	Non-22 value
Allowed users	AllowUsers	Your username only
Key type	Key pair	ed25519
Brute force	Fail2Ban	Enabled

These steps combined make your SSH setup resistant to the vast majority of automated attacks.