SSH is the front door to your server, and it's also one of the most commonly attacked services on the internet. A few basics go a long way.
Use key-based authentication – Far stronger than passwords, and immune to brute-force password guessing entirely once password login is disabled.
Change the default port (22) – Doesn't stop a targeted attacker, but eliminates the constant noise from automated scanners.
Install fail2ban – Automatically bans IPs after repeated failed attempts, drastically cutting down brute-force attempts.
Disable root login – Force attackers to also guess a valid username, not just a password for a known account.
Restrict SSH access by IP where possible, if you only ever connect from a known set of locations.
Do you use all of these already, or is there one you've been putting off?
Last edited: