SSH Security on Linux VPS: Port Change and Key-Based Authentication

A Linux server exposed to the internet with default SSH configuration faces brute force attacks within minutes — an average server receives thousands of failed login attempts daily. SSH security is the first and most critical step in server management. This guide covers the essential steps to harden SSH.

Changing the SSH Port

Default port 22 is the first target of automated scanning tools. Changing the port to a random value between 1024-65535 (e.g., 2222, 4422, or 52222) blocks the vast majority of automated attacks. This is "security through obscurity" — not sufficient alone but narrows the attack surface.

Change the Port 22 line in /etc/ssh/sshd_config. Before making changes, don't forget to open the new port in your firewall, otherwise you'll lose access to your server.

⚠️ Important: Before changing the SSH port, open the new port with UFW or iptables. The sequence is critical: first open the new port, then restart SSH, finally close the old port. Wrong sequence causes server access loss.

Key-Based Authentication

Password-based login is vulnerable to brute force attacks. Completely disable password login by using SSH key pairs (public/private key). Create a modern and secure key pair with ssh-keygen -t ed25519. The Ed25519 algorithm is faster and more secure than RSA.

Security Step	Configuration	Impact
Port Change	Port 2222	Blocks automated scans
Key-Based Login	PubkeyAuthentication yes	Makes brute force impossible
Disable Password	PasswordAuthentication no	Blocks password attacks
Disable Root Login	PermitRootLogin no	Reduces privilege escalation risk
Fail2Ban	maxretry 3, bantime 3600	Blocks repeated attempts
Two-Factor Auth	Google Authenticator PAM	Additional security layer

💡 Tip: Protect your SSH key with a passphrase. A lost or stolen private key without a passphrase provides direct access to your server. Use ssh-keygen -p to add a passphrase.

Fail2Ban Setup

Fail2Ban monitors failed login attempts and automatically blocks IP addresses after a certain number of failures. Install with apt install fail2ban. Set maxretry=3 and bantime=3600 (1 hour) in SSH jail configuration. The Fail2Ban official documentation explains advanced configuration options.

Additional Security Measures

Restrict SSH access to specific IP addresses (AllowUsers or firewall rules). Add two-factor authentication (2FA). Set SSH connection timeout (ClientAliveInterval). Our Linux server security guide explains comprehensive security steps in detail.

Frequently Asked Questions

What happens if I lose my SSH key?

You lose access to your server. Therefore, create a backup key pair or use your hosting provider's console access (VNC/IPMI) to temporarily enable password login.

Does Fail2Ban affect server performance?

No, Fail2Ban uses minimal resources. It monitors log files and only adds iptables rules when attacks are detected. Even thousands of banned IPs don't affect performance.

What is the most secure SSH key algorithm?

Ed25519 is a modern and secure choice. If using RSA, use a minimum 4096-bit key length. DSA and ECDSA are no longer recommended.

SSH security is the cornerstone of Linux VPS management. Protect your server against brute force attacks by applying the trio of port change, key-based login, and Fail2Ban.

Secure VPS Infrastructure

Secure SSH access, DDoS protection, and 24/7 technical support with Hosted Cloud cloud servers.

View Cloud Server Plans