База знаний

SSH is the front door to your VPS — and by default it listens on a well-known port, often accepts weak passwords, and can be reached directly as root. This guide covers the three most effective SSH hardening steps: switching to key-based authentication, changing the default port, and disabling direct root login — safely, without locking yourself out.

Prerequisites

• Ubuntu 22.04/24.04 or Debian 11/12 VPS
• Root or sudo access
• An active SSH session (keep it open throughout this guide)

Golden Rule: Never close your current SSH session until you have successfully opened a new session with the new configuration. This is the #1 cause of VPS lockouts.

Step 1 — Create a Sudo User (Skip if Already Done)

adduser deploy
usermod -aG sudo deploy

Test it in a new terminal window, keeping your root session open:

ssh deploy@YOUR_SERVER_IP
sudo whoami

Expected output: root

Step 2 — Set Up SSH Key Authentication

On your local machine, generate a key pair if you don't already have one:

ssh-keygen -t ed25519 -C "[email protected]"

Copy it to the server:

ssh-copy-id deploy@YOUR_SERVER_IP

Verify you can log in without a password:

ssh deploy@YOUR_SERVER_IP

Step 3 — Change the Default SSH Port

sudo nano /etc/ssh/sshd_config

Find and change:

#Port 22

to an unused port above 1024, for example:

Port 2222

Step 4 — Disable Root Login and Password Authentication

In the same file, set:

PermitRootLogin no
PasswordAuthentication no

PasswordAuthentication no disables password logins entirely — only key-based authentication will work. Only enable this after Step 2 is confirmed working.

Step 5 — Update the Firewall

sudo ufw allow 2222/tcp
sudo ufw status

Do not remove the rule for port 22 yet.

Step 6 — Validate and Restart SSH

sudo sshd -t
sudo systemctl restart ssh

If sshd -t shows no output, the configuration is valid.

Step 7 — Test the New Configuration (Critical)

In a brand-new terminal window — without closing your current session:

ssh -p 2222 deploy@YOUR_SERVER_IP
sudo whoami

Only after this succeeds, remove the old port rule:

sudo ufw delete allow 22/tcp

Verification Checklist

• Can log in with the deploy user on port 2222 using an SSH key
• sudo whoami returns root
• ssh root@YOUR_SERVER_IP on port 22 is refused
• sudo ufw status shows only port 2222 open for SSH

Common Errors

Connection refused on the new port — SSH did not restart correctly. Check:

sudo systemctl status ssh
sudo journalctl -u ssh -n 50

Permission denied (publickey) — your local private key doesn't match the server's authorized_keys. Re-run ssh-copy-id.

Locked out completely — use your VPS provider's web-based console (VNC/serial console) to log in as root through the hypervisor and revert /etc/ssh/sshd_config.

Security Best Practices

• Combine this with Fail2Ban to auto-block repeated failed attempts
• Restrict SSH to trusted IPs where possible: sudo ufw allow from YOUR_IP to any port 2222
• Rotate SSH keys periodically and remove unused authorized_keys entries

FAQ

Does changing the SSH port actually improve security?
It significantly reduces automated bot scanning noise, but is not a substitute for key-based authentication — use both together.

What if I lose my SSH key?
Use your hosting provider's console access to log back in and add a new key to ~/.ssh/authorized_keys.

Continue Reading

• How to Install and Configure Fail2Ban (Ubuntu & Debian)
• How to Configure UFW Firewall on a Linux VPS
• How to Enable Two-Factor Authentication (2FA) for SSH
• VPS Security Checklist for Beginners

Browse more articles in Server Security & Hardening.