Hardening SSH: key-only, no root login, fail2ban

SSH is the most common way into a server; use keys instead of passwords, disable root login, limit users and attempts, test the config before reloading and block brute force with fail2ban.

Why SSH is a target

Every server with SSH open to the internet receives thousands of password attempts a day from bots. Weak or reused passwords are guessed sooner or later. Key-based authentication uses a key pair: the private key on your machine, the public key in ~/.ssh/authorized_keys on the server; bots cannot guess it.

ssh-keygen -t ed25519 -C "fresher@lab"        # create a new key pair
ssh-copy-id -i ~/.ssh/id_ed25519.pub fresher@192.0.2.10

Protect the private key with a passphrase and use ssh-agent to avoid retyping it. Ed25519 is short, fast and recommended; RSA keys should be 3072 bits or more.

Configuring sshd

Put settings in a separate file such as /etc/ssh/sshd_config.d/10-hardening.conf:

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
AllowGroups ssh-users
MaxAuthTries 3
LoginGraceTime 30
X11Forwarding no

Always test before applying, and keep your current SSH session open until a login from another window succeeds:

sudo sshd -t && sudo systemctl reload ssh

On Ubuntu the service is called ssh; on the Red Hat family it is sshd.

fail2ban

fail2ban reads logs, spots IPs that fail repeatedly and bans them temporarily through the firewall. An sshd jail ships ready; enable it in /etc/fail2ban/jail.local with maxretry and bantime, then check with sudo fail2ban-client status sshd.

flowchart LR
  B["Bot tries passwords"] --> S["sshd"]
  S -- "Failed password in the log" --> F["fail2ban"]
  F -- "over maxretry" --> FW["firewall bans the IP"]

A few more layers

Allow SSH only from trusted networks (VPN, bastion, security group).
Add MFA to SSH if needed, or use short-lived SSH certificates.
In the cloud, consider removing public SSH entirely and using AWS Systems Manager Session Manager or Azure Bastion.

Traps: disabling PasswordAuthentication before copying your key to the server; reloading sshd without running sshd -t; changing the SSH port and thinking that makes it secure.