To secure an SSH server, implement strong authentication, limit access, change default settings, configure firewall rules, and keep the system updated. First, enable SSH key pairs with passphrases and disable password authentication entirely after uploading public keys to authorized_keys. Second, restrict root login by setting PermitRootLogin no and allow only specific users or groups using AllowUsers or AllowGroups. Third, change the default SSH port from 22 to a custom port like 2222 in sshd_config and adjust firewall rules accordingly. Fourth, use a firewall such as UFW to allow SSH connections only from trusted IPs and apply rate-limiting with tools like fail2ban to block repeated login attempts. Lastly, regularly update the OS and SSH packages via sudo apt update && sudo apt upgrade and enable automatic updates to protect against known vulnerabilities.

Securing an SSH server is essential for protecting your system from unauthorized access. While SSH itself is a secure protocol, misconfigurations or weak practices can expose your server to attacks. Here are some practical steps you can take to harden your SSH setup.

Use Strong Authentication Methods

One of the first things you should do is move away from weak password-based authentication.

• Enable SSH key pairs – Passwords can be guessed or brute-forced. Using public/private key pairs adds a much higher level of security.

  • Generate a strong key pair using ssh-keygen
  • Set a passphrase for the private key
  • Upload the public key to the server's ~/.ssh/authorized_keys file

• Disable password login entirely
  In your SSH config (/etc/ssh/sshd_config), set:

  PasswordAuthentication no

Make sure you’ve added your public key before disabling passwords — otherwise, you might lock yourself out.

Limit User Access and Login Options

SSH access should only be granted to those who need it.

• Restrict root login
  The root account has full control, so allowing direct login via SSH is risky. Instead, disable it:

  PermitRootLogin no

• Allow only specific users
  Use the AllowUsers directive in sshd_config to limit SSH access to known accounts:

  AllowUsers user1 user2

• Use groups to manage access
  You can also allow logins by group:

  AllowGroups sshusers

This makes managing permissions easier when multiple people need access.

Change the Default SSH Port

Running SSH on port 22 is standard — which means it’s also the first target for attackers. Changing the port won’t stop determined hackers, but it will reduce noise from automated scans.

In sshd_config, change:

Port 2222

Then make sure your firewall allows traffic on that port. This small tweak can significantly cut down on botnet login attempts.

Set Up Firewall Rules and Rate Limiting

Even with good SSH settings, your server can still be exposed to repeated login attempts.

• Use a firewall (like UFW or iptables)
  Only allow SSH connections from trusted IP ranges if possible:

  ufw allow from 192.168.1.0/24 to any port 2222

• Rate-limit connection attempts
  Tools like fail2ban monitor logs and block IPs after repeated failed login attempts. It’s easy to install and configure, and it helps protect against brute-force attacks.

A simple fail2ban rule can block suspicious activity for a few minutes — often enough to deter most scripts.

Keep Your System and SSH Updated

Outdated software is one of the easiest ways for attackers to gain access.

• Regularly update your OS and SSH packages:

  sudo apt update && sudo apt upgrade

• Subscribe to security mailing lists or use tools like unattended-upgrades to apply critical patches automatically.

Older versions of OpenSSH have had serious vulnerabilities — staying updated ensures you’re protected.

That’s basically it. These steps aren't overly complicated, but they go a long way toward securing your SSH server. Some are small tweaks, like changing the port, while others, like using keys and limiting access, are foundational. A little effort upfront can prevent a lot of trouble later.

The above is the detailed content of What are some best practices for securing an SSH server?. For more information, please follow other related articles on the PHP Chinese website!