Install and enable the SSH server using package managers like apt or dnf, then start and verify the service. 2. Harden SSH configuration by changing the default port to 2222, disabling root login with PermitRootLogin no, allowing specific users via AllowUsers, disabling password authentication in favor of SSH keys, generating and copying ed25519 key pairs, limiting authentication attempts with MaxAuthTries 3 and login time with LoginGraceTime 30, and disabling unused authentication methods. 3. Install and configure Fail2Ban by creating a jail.local file, enabling SSH protection on port 2222, setting maxretry to 3 and bantime to 3600, then starting and enabling the service. 4. Further secure the system by keeping it updated with regular patches, configuring firewalls like ufw to allow only port 2222, disabling outdated SSH protocols and ciphers by specifying secure KexAlgorithms, Ciphers, and MACs, and monitoring logs in /var/log/auth.log for suspicious activity. A secure SSH setup requires multiple layers including port changes, disabled root and password logins, key-based authentication, Fail2Ban protection, and system updates, all of which significantly reduce the risk of unauthorized access compared to default configurations.

Setting up a secure SSH server on Linux is essential for safely managing remote systems. While SSH is secure by default in many ways, a few key configuration changes can greatly reduce the risk of unauthorized access. Here’s how to do it right.

1. Install and Enable the SSH Server

Most Linux distributions come with OpenSSH, but it may not be installed or enabled by default.

On Debian/Ubuntu:

sudo apt update
sudo apt install openssh-server
sudo systemctl enable ssh
sudo systemctl start ssh

On RHEL/CentOS/Fedora:

sudo dnf install openssh-server
sudo systemctl enable sshd
sudo systemctl start sshd

Verify it's running:

sudo systemctl status ssh

2. Harden the SSH Configuration

The main SSH config file is located at /etc/ssh/sshd_config. Always back it up before editing:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo nano /etc/ssh/sshd_config

Make the following changes:

• Change the default port
  Using a non-standard port (e.g., 2222) reduces automated bot attacks:

  Port 2222

  Note: Update your firewall and SELinux (if enabled) to allow the new port.

• Disable root login
  Prevent direct root access to limit damage from brute-force attacks:

  PermitRootLogin no

• Allow only specific users
  Restrict SSH access to trusted users:

  AllowUsers yourusername

  You can also use AllowGroups if managing via group membership.

• Disable password authentication (use SSH keys only)
  This is one of the most effective security improvements:

  PasswordAuthentication no

  Make sure you’ve set up SSH keys before enabling this.

• Use key-based authentication
  Generate a key pair on your local machine:

  ssh-keygen -t ed25519

  Copy the public key to the server:

  ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server-ip -p 2222

• Limit authentication attempts and login time

  MaxAuthTries 3
  LoginGraceTime 30

• Disable unused authentication methods

  PubkeyAuthentication yes
  ChallengeResponseAuthentication no
  UsePAM no

After changes, restart SSH:

sudo systemctl restart ssh

?? Test your connection in a second terminal before closing your current session!

3. Use Fail2Ban to Block Brute-Force Attacks

Fail2Ban monitors log files and blocks IPs showing malicious behavior.

Install Fail2Ban:

sudo apt install fail2ban      # Debian/Ubuntu
sudo dnf install fail2ban      # Fedora/RHEL

Create a custom config file:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Enable SSH protection and adjust settings:

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600

Start and enable Fail2Ban:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

4. Harden the System Further

• Keep the system updated
  Regularly apply security patches:

  sudo apt upgrade      # Debian/Ubuntu
  sudo dnf update       # Fedora/RHEL

• Use a firewall
  Configure ufw or firewalld to allow only necessary ports.

  Example with ufw:

  sudo ufw allow 2222
  sudo ufw enable

• Disable unused SSH protocols and ciphers
  In /etc/ssh/sshd_config, explicitly set modern, secure options:

  KexAlgorithms curve25519-sha256
  Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
  MACs hmac-sha2-512-etm@openssh.com

• Monitor logs regularly
  Check /var/log/auth.log (or /var/log/secure on RHEL) for suspicious login attempts.

---

Secure SSH setup isn’t about one magic setting—it’s layers. Change the port, disable root and password login, use SSH keys, install Fail2Ban, and keep the system updated. Most attacks target default configurations, so even small changes make a big difference.

Basically, if you're using SSH keys, blocking root login, and have Fail2Ban running, you’re already far ahead of most servers exposed to the internet.

The above is the detailed content of How to Set Up a Secure SSH Server on Linux. For more information, please follow other related articles on the PHP Chinese website!