Secure your SSH server

Protect your server against brute-force attacks: SSH keys, fail2ban, a non-default port and further hardening steps.

Step 1: Create an SSH key

On your local machine (not on the server):

# Generate an Ed25519 key (more secure and shorter than RSA)
ssh-keygen -t ed25519 -C "dein@email.de"

# Accept the default path: ~/.ssh/id_ed25519
# Set a passphrase (recommended)

Step 2: Copy the key to the server

# Copy the public key to the server
ssh-copy-id -i ~/.ssh/id_ed25519.pub benutzer@deine-server-ip

# Test: login should now work without a password
ssh benutzer@deine-server-ip

Step 3: Prepare the firewall (old AND new port)

Allow both the current SSH port 22 and the new port 2222 first – only then enable the firewall. That way your current connection keeps working.

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp      # Current SSH port – stays open for now!
sudo ufw allow 2222/tcp    # New SSH port
sudo ufw allow 80/tcp      # HTTP (only if you run a web server)
sudo ufw allow 443/tcp     # HTTPS (only if you run a web server)
sudo ufw enable

# Check the rules
sudo ufw status verbose

Step 4: Harden the SSH configuration

Put your settings into a separate file under /etc/ssh/sshd_config.d/. On Ubuntu, files there take precedence over sshd_config (for most options, OpenSSH uses the first value it reads). The prefix 00- makes sure your file is read before others, e.g. a 50-cloud-init.conf that re-enables password login.

sudo nano /etc/ssh/sshd_config.d/00-hardening.conf

# Content of the file (comments only on their own lines):
# New SSH port
Port 2222
# Disallow root login – only if you log in as a sudo user!
PermitRootLogin no
# Disable password login (incl. keyboard-interactive)
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
# Max. login attempts and idle timeout
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2

# Check the syntax – no output means OK
sudo sshd -t

# Show the effective values
sudo sshd -T | grep -Ei '^(port|permitrootlogin|passwordauthentication) '

Step 5: Apply the change (Ubuntu 22.04 vs. 24.04)

On Ubuntu the service is called ssh (not sshd). Since Ubuntu 22.10 – and therefore on 24.04 – SSH uses systemd socket activation by default: the port is opened by ssh.socket, which a systemd generator configures from your sshd configuration. A simple restart of the service is then not enough for a port change. Check which mode your server uses:

systemctl is-active ssh.socket
# "active"   -> socket activation (default on Ubuntu 24.04)  -> variant B
# "inactive" -> classic service   (Ubuntu 22.04)             -> variant A

# Variant A – Ubuntu 22.04 (no socket activation)
sudo systemctl restart ssh

# Variant B – Ubuntu 24.04 (socket activation)
sudo systemctl daemon-reload        # re-runs the generator, ssh.socket gets port 2222
sudo systemctl restart ssh.socket   # socket now listens on the new port
sudo systemctl restart ssh          # loads the remaining settings (e.g. PasswordAuthentication)

# Check: sshd must now listen on 2222
sudo ss -tlnp | grep -E ':(22|2222)\b'

Optional: if you prefer the classic behaviour on 24.04, you can disable socket activation instead (as described in the package's README.Debian). Afterwards Variant A applies:

sudo mkdir -p /etc/systemd/system-generators/
sudo ln -s /dev/null /etc/systemd/system-generators/sshd-socket-generator
sudo systemctl daemon-reload
sudo systemctl disable --now ssh.socket
sudo systemctl enable --now ssh.service

Step 6: Test the new port in a second session

Leave the first session open and open a new terminal on your local machine:

# In a NEW terminal – the old session stays open
ssh -p 2222 benutzer@deine-server-ip

# Only if this login works: close the old port 22
sudo ufw delete allow 22/tcp
sudo ufw status verbose

Step 7: Install and configure fail2ban

Create /etc/fail2ban/jail.local with only your own settings – the defaults stay in jail.conf. Enter the new SSH port here, otherwise fail2ban blocks the wrong port.

sudo apt install -y fail2ban
sudo nano /etc/fail2ban/jail.local

# Content of /etc/fail2ban/jail.local:
[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600
findtime = 600

# Enable fail2ban and load the configuration
sudo systemctl enable --now fail2ban
sudo systemctl restart fail2ban

# Check the status
sudo fail2ban-client status sshd