{"id":576,"date":"2026-07-16T14:13:19","date_gmt":"2026-07-16T14:13:19","guid":{"rendered":"https:\/\/server.ua\/en\/blog\/?p=576"},"modified":"2026-07-16T14:15:49","modified_gmt":"2026-07-16T14:15:49","slug":"how-to-secure-ssh-on-a-linux-vps","status":"publish","type":"post","link":"https:\/\/server.ua\/en\/blog\/how-to-secure-ssh-on-a-linux-vps","title":{"rendered":"How to Secure SSH on a Linux VPS"},"content":{"rendered":"\n
\"SSH
Secure SSH starts with proper server access settings<\/figcaption><\/figure>\n\n\n\n

As soon as a Linux VPS<\/a> is set up, you receive an IP address and the credentials for the first login. The server is already online at this point. It may take automated scanners only a few minutes to find it, check the default port, try a set of common usernames and start guessing passwords.<\/p>\n\n\n\n\n\n\n\n

Most Linux VPS administration is done over SSH. It gives you remote access to the server\u2019s command line from your own computer. That is where you install software, edit configuration files, manage data and restart services when needed. For many VPS owners, SSH is the main way into the server, which also makes it one of the first things that needs attention.<\/p>\n\n\n\n

Blocking SSH altogether would solve the wrong problem. You still need a reliable way to manage the VPS. The real task is to keep that route open for the administrator without leaving it equally accessible to everyone else.<\/p>\n\n\n\n

Create Another User Account<\/h2>\n\n\n\n

Many VPS instances are initially accessed as root<\/code>. This account can change almost anything on the system. If its password is compromised, the person who gets in does not receive limited access. They receive control of the server.<\/p>\n\n\n\n

A separate account is better for regular administration. It can be given permission to run privileged commands through sudo<\/code> whenever those rights are actually needed.<\/p>\n\n\n\n

Do not disable root<\/code> access immediately after creating the user. First log in through the new account and check that it can perform the required administrative tasks. A user that exists but cannot use sudo will not help once direct root<\/code> login has been turned off.<\/p>\n\n\n\n

Use an SSH Key Instead of a Password<\/h2>\n\n\n\n

Automated tools can keep submitting password attempts for hours or days. Key-based authentication does not rely on a reusable password sent during login.<\/p>\n\n\n\n

An SSH key comes in two parts. The public key is placed on the VPS, while the private key stays on the administrator\u2019s device. The server allows the login only when the two parts match. The private key should never be uploaded to the server or shared with anyone.<\/p>\n\n\n\n

Test the key from a second terminal window after adding it. Leave the original SSH session open. File permissions may be wrong, the public key may have been copied incorrectly, or the new account may be using the wrong directory. An active session gives you a chance to correct this without resorting to recovery access.<\/p>\n\n\n\n

Once the key works, password login can be disabled with PasswordAuthentication no<\/code>. Set PermitRootLogin no<\/code> to prevent direct root<\/code> access. Check the edited configuration before restarting SSH. A typing error here can prevent the service from starting correctly.<\/p>\n\n\n\n

Keep Unnecessary Ports Closed<\/h2>\n\n\n\n

A new VPS does not need to accept connections on every port. A typical web server usually requires HTTP, HTTPS and SSH. Other ports should remain closed unless a particular application genuinely needs them.<\/p>\n\n\n\n

This is handled by a firewall. It filters incoming connections before they reach the service behind the port. That also helps when an application has been enabled accidentally or is listening on an interface you did not expect.<\/p>\n\n\n\n

Make sure the current SSH port is allowed before enabling the firewall. Otherwise, the rule meant to protect the VPS may lock you out of it.<\/p>\n\n\n\n

SSH can also be restricted to a particular IP address. This works well when administration always takes place from one office or another connection with a static address. It becomes less practical when you switch between home internet, mobile data and different workplaces.<\/p>\n\n\n\n

Is Changing the SSH Port Worth It<\/h2>\n\n\n\n

Port 22 is the default for SSH, so automated scanners check it constantly. Moving the service to another port usually reduces random login attempts and makes the authentication logs less cluttered.<\/p>\n\n\n\n

It should not be treated as a major security measure, though. Scanners can find an SSH service running on a different port. The change hides it from the simplest automated checks, not from a targeted scan.<\/p>\n\n\n\n

Open the new port in the firewall before changing the SSH configuration. Then connect through it in another terminal session. Keep port 22 available until you know the replacement works. Key authentication and disabled root<\/code> and password logins provide far more protection than an unusual port number.<\/p>\n\n\n\n

Block Repeated Login Attempts<\/h2>\n\n\n\n

Failed SSH logins may continue even after the main settings have been tightened. This is normal for a publicly reachable server. Fail2Ban can read the authentication logs, identify addresses producing repeated failures and block them for a limited period.<\/p>\n\n\n\n

It is particularly useful when SSH cannot be restricted to one trusted IP address. The server remains reachable from different networks, while obvious automated guessing is slowed down.<\/p>\n\n\n\n

Fail2Ban is still an extra layer, not the foundation of the setup. It does not make a weak password safe and cannot compensate for unrestricted root<\/code> login. Those problems need to be removed in the SSH configuration itself.<\/p>\n\n\n\n

Test Everything Before Logging Out<\/h2>\n\n\n\n

Open a new connection when the changes are complete. Confirm that the SSH key is accepted. Try password authentication and make sure it fails. Check that root<\/code> can no longer log in directly and that the firewall allows the correct port.<\/p>\n\n\n\n

Only close the original session after these checks. Keeping one working connection open may feel unnecessary, but it is often what prevents a small configuration mistake from turning into a recovery job.<\/p>\n\n\n\n

If SSH access is lost, the hosting provider\u2019s VNC or browser console may offer another route into the VPS. It displays the server screen without using SSH, so you can undo a bad firewall rule or repair the configuration. Check whether this option is available before you begin changing remote access settings.<\/p>\n","protected":false},"excerpt":{"rendered":"

As soon as a Linux VPS is set up, you receive an IP address and the credentials for the first login. The server is already online at this point. It may take automated scanners only a few minutes to find it, check the default port, try a set of common usernames and start guessing passwords.<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[28,53,200],"class_list":["post-576","post","type-post","status-publish","format-standard","hentry","category-security","tag-linux-vps-security","tag-server-configuration","tag-ssh"],"_links":{"self":[{"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/posts\/576","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/comments?post=576"}],"version-history":[{"count":3,"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/posts\/576\/revisions"}],"predecessor-version":[{"id":580,"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/posts\/576\/revisions\/580"}],"wp:attachment":[{"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/media?parent=576"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/categories?post=576"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/server.ua\/en\/blog\/wp-json\/wp\/v2\/tags?post=576"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}