SSH is the main entry point to servers and the most common target of automated attacks. Every server with a public IP faces thousands of SSH brute-force attempts daily. Proper hardening is the first and most important step after deploying a server — without it, it is only a matter of time before an attacker gains access.
Keys¶
ssh-keygen -t ed25519 -C 'admin@server'
ssh-copy-id user@server
Ed25519 keys are more secure and faster than RSA. Protect the private key with a strong passphrase and never copy it to servers. For larger organizations, consider SSH CA (Certificate Authority), which eliminates the need to distribute public keys to every server — instead, the server trusts certificates signed by the CA.
sshd Configuration¶
PasswordAuthentication no
PermitRootLogin no
AllowUsers admin deploy
Port 2222
MaxAuthTries 3
KexAlgorithms curve25519-sha256
Ciphers [email protected],[email protected]
Disabling passwords is the most effective measure — it eliminates an entire category of brute-force attacks. Changing the port from 22 to a non-standard one reduces the volume of automated scans by 99%. AllowUsers restricts login to specific users, preventing access through system accounts.
Fail2ban¶
sudo apt install fail2ban
# /etc/fail2ban/jail.local
[sshd]
enabled = true
maxretry = 3
bantime = 3600
Fail2ban monitors logs and automatically blocks IP addresses after repeated failed attempts. For production servers, increase bantime to 86400 (24 hours) and set findtime to 600 seconds. Fail2ban supports email notifications and integration with firewalld or nftables.
Additional Measures¶
- 2FA — Google Authenticator PAM module adds a second layer of protection
- Port knocking — knockd requires a specific packet sequence before opening the SSH port
- Firewall — allow SSH access only from trusted IPs and VPN
- SSH CA — centralized access management instead of distributing keys to every server
SSH Hardening Is a Must¶
Minimum for every server: key authentication, disabled passwords, disabled root login, and fail2ban. These four steps eliminate most common attacks.