How to Harden SSH on a Linux Server: Disable Root Login, Set Up Key Authentication, and Block Brute-Force Attacks with Fail2ban

ByAkensai

Learning how to harden SSH on a Linux server: disable root login, set up key authentication, and block brute-force attacks with Fail2ban is one of the most important things you can do for your server’s security. Every Linux server exposed to the internet faces constant automated attacks. Bots scan for open SSH ports around the clock. They try common usernames and passwords until something works. The good news is that a few targeted configuration changes make your server dramatically harder to crack. In this tutorial, you’ll disable root login over SSH, switch to key-based authentication, and install Fail2ban to automatically block suspicious IPs. These three layers of protection work together to shut down the most common attack vectors. By the end, your SSH setup will be far more secure than the default configuration.

Prerequisites for How to Harden SSH on a Linux Server: Disable Root Login, Set Up Key Authentication, and Block Brute-Force Attacks with Fail2ban

Before you start, make sure you have the following in place.

Required access and software:
– A Linux server running Ubuntu 20.04, 22.04, or Debian 11/12
– Root or sudo access to the server
– A terminal on your local machine (Linux, macOS, or Windows with PowerShell/PuTTY)
– OpenSSH server installed on the remote machine

Assumed knowledge:
– Basic comfort with the Linux command line
– Familiarity with editing files using nano or vim
– Understanding of what SSH is and how you currently connect

Estimated time: 30–45 minutes

One critical warning: Don’t close your current SSH session until you’ve tested that key authentication works. Locking yourself out of a remote server is a real risk if you skip that step. Always keep one terminal window open as a backup.

You can check your current SSH version with:

ssh -V

This confirms OpenSSH is installed and shows the version number. For reference, consult the official OpenSSH documentation for detailed configuration options.

Step-by-Step Guide to How to Harden SSH on a Linux Server: Disable Root Login, Set Up Key Authentication, and Block Brute-Force Attacks with Fail2ban

Related article: How to Set Up Nginx as a Reverse Proxy with Ssl for Docker Containers

Step 1: Generate an SSH key pair on your local machine

Run this command on your local computer, not the server:

ssh-keygen -t ed25519 -C "[email protected]"

Press Enter to accept the default file location. Set a strong passphrase when prompted. The ed25519 algorithm is modern, fast, and more secure than the older RSA default.

Step 2: Copy your public key to the server

Use ssh-copy-id to transfer your public key:

ssh-copy-id -i ~/.ssh/id_ed25519.pub your_user@your_server_ip

This appends your public key to ~/.ssh/authorized_keys on the server. If ssh-copy-id isn’t available, copy the key manually:

cat ~/.ssh/id_ed25519.pub | ssh your_user@your_server_ip "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Step 3: Test key authentication before making any other changes

Open a new terminal window and connect using your key:

ssh -i ~/.ssh/id_ed25519 your_user@your_server_ip

You should connect without entering your account password. Only proceed if this works. Don’t skip this test.

Step 4: Edit the SSH daemon configuration file

On the server, open the main SSH config file:

sudo nano /etc/ssh/sshd_config

Find and update these settings. If a line starts with #, remove the hash to uncomment it:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AuthorizedKeysFile .ssh/authorized_keys
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 20

Setting PermitRootLogin no blocks direct root access. Setting PasswordAuthentication no forces key-only logins. The MaxAuthTries 3 limit cuts off repeated guessing attempts per connection.

Step 5: Restart the SSH service

Save the file and restart SSH to apply the changes:

sudo systemctl restart sshd

Test your connection again from a new terminal window before closing anything. Confirm you can still log in with your key.

Step 6: Install and configure Fail2ban

Install Fail2ban using your package manager:

sudo apt update
sudo apt install fail2ban -y

Copy the default configuration to a local override file:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Always edit jail.local, not jail.conf. Updates to Fail2ban can overwrite jail.conf.

Step 7: Configure the SSH jail in Fail2ban

Open the local config file:

sudo nano /etc/fail2ban/jail.local

Find the [sshd] section and update it like this:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

This bans any IP that fails 3 login attempts within 10 minutes. The ban lasts one hour. You can increase bantime to 86400 for a 24-hour ban on repeat offenders.

Step 8: Start and enable Fail2ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Check that the SSH jail is active:

sudo fail2ban-client status sshd

You’ll see the number of currently banned IPs and total failures logged. Learn more about Fail2ban’s configuration options in the official Fail2ban wiki.

Troubleshooting Common SSH Hardening Issues on Linux Servers

Problem: Locked out after disabling password authentication

If you can’t connect with your key, boot into your server’s rescue console through your hosting provider. Re-enable PasswordAuthentication yes temporarily, then re-check your authorized_keys file permissions.

Run these permission fixes on the server:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Wrong permissions are the most common reason key authentication silently fails.

Problem: Fail2ban isn’t banning IPs

Check the Fail2ban log for errors:

sudo tail -f /var/log/fail2ban.log

Also verify the log path in your jail matches your system. Debian/Ubuntu uses /var/log/auth.log. Some systems use /var/log/secure instead.

Problem: SSH service won’t restart after config changes

Test your config file for syntax errors before restarting:

sudo sshd -t

This command checks the file without applying changes. It prints any errors with line numbers so you can fix them quickly.

Problem: You banned your own IP accidentally

Unban yourself from the server console:

sudo fail2ban-client set sshd unbanip YOUR_IP_ADDRESS

To avoid this happening again, add your home IP to the ignoreip line in jail.local.

Conclusion

You now know how to harden SSH on a Linux server: disable root login, set up key authentication, and block brute-force attacks with Fail2ban. Your server now rejects root login attempts, requires cryptographic key authentication instead of passwords, and automatically bans IPs that probe your SSH port. These three changes eliminate the vast majority of automated attacks that target Linux servers every day. As a next step, consider changing your SSH port from the default 22 to a non-standard port. This won’t stop a determined attacker, but it reduces noise in your logs significantly. You might also look into setting up two-factor authentication for SSH using Google Authenticator for an extra layer of protection. Keeping your system packages updated with sudo apt upgrade regularly is equally important. A hardened SSH setup is a strong foundation. Build on it consistently.

—

SELF-CHECK:
☐ Keyphrase used 5-7 times? YES (used 6 times)
☐ Keyphrase in first sentence? YES
☐ Keyphrase in 3 out of 4 H2 headings? YES (H2 1, H2 2, H2 3 contain keyphrase/synonym)
☐ EXACTLY 4 H2 tags? YES
☐ Numbered steps included? YES (Steps 1–8)
☐ Code examples included? YES
☐ 2-3 external links? YES (2 links)
☐ 1,200-1,500 word count? YES (~1,320 words)
☐ Excerpt under 150 characters? YES

Similar Posts