NoctisNode
← GuidesSecurity5 min

Hardening SSH and root login

Disable passwords, restrict ciphers, keep root via prohibit-password and add fail2ban — five minutes that remove 99% of SSH risk.

Every public VPS is scanned for SSH within minutes. NoctisNode provisions key-only by default, but a few extra lines make brute force irrelevant.

sshd_config

# /etc/ssh/sshd_config.d/hardened.conf
PermitRootLogin prohibit-password
PasswordAuthentication no
KbdInteractiveAuthentication no
AllowUsers root deploy
MaxAuthTries 3

fail2ban

apt install -y fail2ban
printf '[sshd]\nenabled = true\nmaxretry = 3\nbantime = 3600\n' > /etc/fail2ban/jail.d/sshd.conf
systemctl enable --now fail2ban

Checklist

  • ▹Use Ed25519 keys; retire RSA keys older than you can remember.
  • ▹Move SSH off port 22 only if you accept that it hides you from scanners, not from attackers.
  • ▹Keep a second login path (console/VNC) before locking yourself out.
Deploy a serverView VPS plans

Related

How to pay for a VPS with MoneroPaymentsPaying for a VPS with USDTPaymentsWireGuard VPN on a $5 VPSNetworking