SSH Hardening on VPS for Maximum Security

June 2026 · 8 min read

SSH is the primary gateway to every VPS and the first target that bots and hackers attempt to breach. Looking at server logs, you'll see thousands of login attempts daily. This article systematically closes security gaps one by one.

1. Change Port from 22

Port 22 is the default that bots scan constantly. Changing it to a different number greatly reduces noise from automated attacks.

# Edit sshd_config file
nano /etc/ssh/sshd_config

# Find the Port line and change it
Port 2222   # or any port between 1024–65535

ufw allow 2222/tcp
systemctl reload sshd

2. Disable Root Login

# In sshd_config
PermitRootLogin no

You must log in with a regular user first, then use sudo to elevate to root instead.

3. Use Key-Based Authentication Instead of Passwords

# Generate key pair on your local machine (not on the VPS)
ssh-keygen -t ed25519 -C "myserver"

# Copy public key to VPS
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@your-vps-ip

After successfully testing key-based login, disable password authentication:

# In sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

4. Restrict SSH Access to Specific Users

# In sshd_config — specify only the users allowed
AllowUsers deploy admin

5. Set Idle Timeout

# In sshd_config
ClientAliveInterval 300
ClientAliveCountMax 2

Sessions with no activity for 10 minutes will be automatically disconnected.

6. Disable X11 Forwarding and Unused Features

X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PrintMotd no

7. Set Login Grace Time and Max Retries

LoginGraceTime 30
MaxAuthTries 3
MaxSessions 5

8. Use Ed25519 Instead of RSA

Ed25519 is more secure and faster than RSA 2048/4096. If you're still using RSA, regenerate your keys:

ssh-keygen -t ed25519 -a 100

Reload and Verify Configuration

# Check syntax before reloading
sshd -t

# Reload
systemctl reload sshd

# View status
systemctl status sshd

Quality VPS with Reliable Hosting

SSH hardening is helpful, but if you want a VPS with strong infrastructure from the start, rent a Thai VPS from asiagb with built-in DDoS protection and 24/7 Thai language support.

Beyond SSH, you should also check your domain health and web security headers. Try dnsxray.com, which checks SSL, DNS, HSTS, and response headers all in one free page.

Quick Checklist

• Change port from 22
• Disable PermitRootLogin
• Use key-based auth and disable password login
• Set AllowUsers to specify only necessary users
• Set idle timeout and max retries
• Disable unused features (X11, TCP forwarding)
• Install Fail2ban alongside

Verify SSH Hardening is Working Correctly

# Check sshd config again
sshd -T | grep -E "port|permitrootlogin|passwordauth|pubkeyauth|allowusers"

# View recent connection attempts
grep "Failed password" /var/log/auth.log | tail -20
grep "Accepted publickey" /var/log/auth.log | tail -10

# Check if brute force attacks have decreased
grep "Invalid user" /var/log/auth.log | wc -l

Common Issues & Troubleshooting

Error: "Connection refused" after changing SSH port

The firewall hasn't opened the new port, or sshd hasn't reloaded yet:

# Open new port in UFW
ufw allow 2222/tcp
ufw status | grep 2222

# Check that sshd is listening on the new port
ss -tlnp | grep sshd
# You should see :2222

# Reload sshd
systemctl reload sshd

Error: "Permission denied (publickey)" after disabling password auth

The key hasn't been copied to the VPS, or authorized_keys permissions are incorrect:

# Check authorized_keys
cat ~/.ssh/authorized_keys
# Must contain your machine's public key

# Check permissions (very important)
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chown USER:USER ~/.ssh ~/.ssh/authorized_keys

# View SSH debug on client side
ssh -v -p 2222 user@vps-ip

Error: "Too many authentication failures"

SSH client tried multiple keys and exceeded MaxAuthTries:

# Specify the key directly when connecting
ssh -i ~/.ssh/id_ed25519 -p 2222 user@vps-ip

# Or edit ~/.ssh/config on your machine
Host myserver
    HostName vps-ip
    Port 2222
    User myuser
    IdentityFile ~/.ssh/id_ed25519
    IdentitiesOnly yes

Locked out of VPS entirely (no console access)

You'll need to use KVM/VNC console from your VPS provider, which connects directly to the server without SSH:

# In your provider's console, log in as root and edit sshd_config
# Change the port back or temporarily enable password auth
PasswordAuthentication yes
systemctl restart sshd

Frequently Asked Questions

Does changing the SSH port really help?

It reduces noise significantly from bots that only scan port 22, but it's not true security. Disabling password auth and using key-based auth is more important. Changing the port is security-by-obscurity that supplements your main defenses.

Do I need both SSH keys and Fail2ban?

Yes, both are recommended. SSH keys prevent login via password entirely. Fail2ban blocks IPs that probe repeatedly. Both work together to reduce your attack surface and log noise.

If I work from multiple IPs like home and office, what do I do?

If you disable password auth, you need your private key on every machine you'll use for login, or you can use SSH agent forwarding. Instead of restricting by IP, use AllowUsers to specify which users are permitted, since IP addresses change frequently.