Lock down SSH on a Linux VPS: a complete checklist

SSH is the front door to a Linux server, and bots try to guess SSH passwords on every public IP all day. Locking it down takes about fifteen minutes and removes the most common way servers get compromised. This checklist pulls together the individual guides in the right order.

Before you start

• Root or sudo access to the VPS. See connect to a Linux VPS with SSH.
• Your provider's web console (VNC) as a backup way in.
• Keep one SSH session open the whole time and test every change from a second session.

Use SSH keys

1. Create a key pair on your computer and copy the public key to the server, following set up SSH keys.
2. Log in with the key from a new terminal to confirm it works before going further.

Disable password and root login

1. Create a normal user with sudo rights if you do not have one, and give it your key.
2. Edit the SSH configuration:
   Copy

   nano /etc/ssh/sshd_config

3. Set these values:
   Copy

   PasswordAuthentication no
   PermitRootLogin prohibit-password
   MaxAuthTries 3
   LoginGraceTime 30
   X11Forwarding no

   Use PermitRootLogin no if you always log in as your sudo user. Details: disable root SSH login.
4. Check the syntax and reload:
   Copy

   sshd -t && systemctl reload sshd

Limit SSH in the firewall

The strongest step is allowing port 22 only from IPs you trust:

If your IP changes often, rate limit instead, for example ufw limit 22/tcp, or connect through a VPN.

Ban brute-force attempts

Install fail2ban on plain Linux servers (install fail2ban), or rely on LFD on CSF servers (tune LFD).

Optional extras

• Move SSH to another port to cut log noise: change the SSH port safely. This is not real security on its own.
• Remove old algorithms: disable weak SSH ciphers.
• Restrict who may log in with AllowUsers deploy admin in sshd_config.
• Keep the system patched: automatic security updates.

Check afterwards

• From another machine, ssh -o PreferredAuthentications=password user@server should be refused.
• journalctl -u sshd --since today (or /var/log/secure) should show failed bots being cut off.
• If you are locked out, use the console and follow firewall lockout recovery.

Next steps

• Fix SSH connection refused or timeout
• Compare Linux firewalls
• What is a firewall?