The first time I hardened SSH on a server, my biggest concern was not an attacker. It was accidentally locking myself out. SSH is one of the most useful administration tools on Ubuntu, but because it provides remote command-line access, weak authentication or careless configuration can expose a server to unnecessary risk.
Learning How to Secure SSH on Ubuntu Server means strengthening authentication, restricting unnecessary access, filtering network traffic, monitoring login activity, and testing every change before closing your working connection. The safest approach is layered security rather than relying on one trick such as changing the default SSH port.
Why SSH Security Matters on Ubuntu
Internet-facing SSH servers are constantly scanned by automated systems searching for weak passwords, exposed root accounts, outdated software, and common configuration mistakes.
A secure SSH setup therefore starts with reducing the number of ways an attacker can authenticate. Strong SSH keys, restricted accounts, firewall controls, login limits, and server monitoring work together to provide far stronger protection than passwords alone.
Ubuntu uses OpenSSH for remote administration. Its configuration is powerful, but even a small syntax error can interrupt remote access. That makes testing and configuration validation essential parts of SSH hardening.
Prepare Your Ubuntu Server Before SSH Hardening
Before modifying SSH, update your installed packages:
sudo apt update
sudo apt upgrade
Security updates can patch vulnerabilities in OpenSSH and related system components.
You should also avoid making major SSH changes while relying on a single active connection. Keep your existing terminal open and create a second session whenever testing authentication changes. If the new connection fails, your original session gives you a way to repair the configuration.
Create a Non-Root Administrative User
Logging directly into the root account increases risk because attackers already know the username they need to target.
Create a regular account and grant it administrative privileges:
sudo adduser adminuser
sudo usermod -aG sudo adminuser
Verify that the new account can log in and run commands through sudo before restricting root access.
Using individual administrative accounts also makes activity easier to trace when several people manage the same server.
Set Up SSH Key Authentication
SSH keys are significantly harder to guess or brute-force than ordinary passwords.
On your local computer, generate an Ed25519 key:
ssh-keygen -t ed25519
Use a strong passphrase when practical. The private key should remain only on your trusted device.
Copy the public key to your Ubuntu server:
ssh-copy-id adminuser@server-ip
Open another terminal and verify that key-based authentication works successfully before changing password settings.
Disable SSH Password Authentication
Once key authentication works reliably, password login can be disabled.
Ubuntu supports the main configuration file:
/etc/ssh/sshd_config
Modern Ubuntu installations can also use custom configuration snippets inside:
/etc/ssh/sshd_config.d/
Using a dedicated configuration snippet can make your security changes easier to maintain.
Configure:
PasswordAuthentication no
PubkeyAuthentication yes
Never disable passwords until you have confirmed that your SSH key works from another terminal.
Disable Direct Root SSH Login
Add:
PermitRootLogin no
Administrators can instead connect through their regular accounts and use sudo when privileged commands are required.
This removes a predictable high-value login target while improving accountability.
Restrict Which Users Can Use SSH
If only specific accounts need remote access, explicitly permit them.
For example:
AllowUsers adminuser
You can also use AllowGroups when several authorized administrators belong to a dedicated group.
Restricting SSH access reduces the number of valid accounts an attacker can target.
Reduce Authentication Attempts
OpenSSH provides settings that can make repeated login attempts less effective.
Consider:
MaxAuthTries 3
LoginGraceTime 30
MaxAuthTries limits authentication attempts per connection, while LoginGraceTime controls how long users have to authenticate.
Avoid extremely restrictive values that could inconvenience legitimate administrators.
Validate SSH Configuration Before Restarting
One of the most important SSH security practices is checking your configuration before applying it.
Run:
sudo sshd -t
If no configuration errors appear, reload or restart SSH:
sudo systemctl restart ssh
Do not immediately close your original session. Open another connection and confirm that everything still works.
Protect SSH With a Firewall
Ubuntu’s UFW firewall can restrict incoming SSH traffic.
Enable SSH access before activating the firewall:
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status
When administrators connect from predictable networks, restricting SSH to trusted IP addresses offers even stronger protection.
Firewall filtering reduces unnecessary exposure before authentication even begins.
Use Fail2Ban Against Repeated Login Attempts
Fail2Ban monitors logs and temporarily blocks IP addresses displaying suspicious behavior.
Install it using:
sudo apt install fail2ban
A properly configured SSH jail can help reduce automated password attacks and excessive connection attempts.
However, Fail2Ban should complement strong authentication rather than replace SSH keys or firewall restrictions.
Should You Change SSH Port 22?
Changing the default SSH port may reduce automated scans and noisy logs because many bots initially probe port 22.
It should not be treated as a primary security control.
Attackers can scan alternative ports, so SSH keys, disabled passwords, restricted users, firewall rules, and monitoring remain far more important.
Consider Two-Factor Authentication
Servers containing particularly sensitive systems can add another authentication factor.
Two-factor authentication can require something the administrator possesses in addition to a key or password. Depending on the environment, this may involve authentication applications or hardware-backed security devices.
Advanced environments may also restrict SSH behind VPNs, bastion hosts, or private network access.
Monitor SSH Login Activity
Hardening should continue after configuration.
You can inspect SSH service activity using:
sudo journalctl -u ssh
Authentication information may also be available through:
/var/log/auth.log
Look for repeated failed logins, unfamiliar users, unexpected source addresses, or unusual login times.
Regular monitoring can reveal suspicious behavior that preventive controls alone might not stop.
What to Do If SSH Stops Working
If a new SSH session fails, keep your existing connection open.
Check configuration syntax again:
sudo sshd -t
Then inspect service status:
sudo systemctl status ssh
Review recent SSH logs for authentication or configuration errors.
If your hosting environment offers a recovery console, keep its access details available before performing major SSH changes.
Frequently Asked Questions
1. What is the safest way to secure SSH on Ubuntu?
The safest approach combines key-based authentication, disabled root access, restricted users, firewall rules, configuration validation, updates, monitoring, and careful testing before disconnecting existing sessions.
2. Should I disable SSH password authentication?
Yes, once SSH key authentication has been successfully configured and tested. Disabling passwords greatly reduces exposure to password guessing and automated brute-force attempts.
3. Is Fail2Ban necessary when SSH keys are enabled?
Not always. SSH keys already provide strong protection, but Fail2Ban can still reduce unwanted connection attempts, log noise, and abusive automated traffic.
4. How to Secure SSH on Ubuntu Server without locking yourself out?
Keep an existing SSH connection open, test key authentication in a second terminal, run sshd -t before restarting SSH, and confirm a fresh connection works before disconnecting.
A Safer SSH Setup Starts With Layers
When I secure an Ubuntu server, I never depend on one setting. I treat SSH security as a layered process: strong keys protect authentication, account restrictions reduce exposure, firewalls control network access, Fail2Ban limits abusive behavior, and monitoring helps detect unusual activity.
The most important lesson in How to Secure SSH on Ubuntu Server is to make every security change carefully and verify it before moving forward. A hardened SSH configuration is useful only when authorized administrators can still reach the machine safely.
Leave a Reply