Secure SSH on your server

Log in with an SSH key instead of a password, turn off password logins and root logins with a password, block repeated failed logins with fail2ban, and do it without locking yourself out.

Aktualisiert am 21 Oktober 2026 4 Min. Lesezeit

Die Artikel sind auf Englisch geschrieben.

Servers on the internet get password guesses on SSH all day. This guide moves you to SSH keys, turns off password logins and adds fail2ban. The commands are for Ubuntu and Debian.

Create an SSH key on your own computer#

Run this on your own computer, not on the server. It works on Linux, macOS and Windows 10 or newer (in PowerShell or Terminal).

ssh-keygen -t ed25519

Press Enter to keep the default location, and choose a passphrase: it protects the key if someone copies it from your computer. This creates two files in the .ssh folder in your home folder:

id_ed25519: your private key. Never share it and never put it on a server.
id_ed25519.pub: your public key. This one goes on the server.

Put your public key on the server#

On Linux and macOS:

ssh-copy-id username@your-server

Replace username and your-server with your user and the address of your server. You log in with your password one last time.

On Windows, or if ssh-copy-id is missing, do it by hand. Show your public key on your own computer:

cat ~/.ssh/id_ed25519.pub

Then, logged in on the server as the user you want to log in as:

mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste the key on its own line, save, and set the rights:

chmod 600 ~/.ssh/authorized_keys

Now open a new terminal and log in. If SSH no longer asks for the server password (it may ask for the passphrase of your key), the key works.

Turn off password logins#

Only do this after logging in with your key has worked.

Create a settings file of your own. Files in /etc/ssh/sshd_config.d/ are read before the rest of the configuration, and for each setting the first value SSH reads is the one it uses. The files are read in alphabetical order, so a name starting with 00 comes first:
```
sudo nano /etc/ssh/sshd_config.d/00-hardening.conf
```
Put these lines in it:
```
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
```
PermitRootLogin prohibit-password lets root log in only with a key, never with a password. Use PermitRootLogin no if you log in as another user and use sudo; check that that user has sudo rights first.
Check the configuration for mistakes. No output means it is fine:
```
sudo sshd -t
```
Check which values SSH will really use:
```
sudo sshd -T | grep -Ei '^(passwordauthentication|kbdinteractiveauthentication|permitrootlogin|pubkeyauthentication)'
```
You should see passwordauthentication no, kbdinteractiveauthentication no and pubkeyauthentication yes. If a value is still yes, another file sets it first: look in /etc/ssh/sshd_config.d/.
Restart SSH. Your open session stays connected:
```
sudo systemctl restart ssh
```
Test from a new terminal that logging in with your key still works. To check that passwords are refused, try:
```
ssh -o PubkeyAuthentication=no username@your-server
```
It should say Permission denied (publickey).

Block repeated failed logins with fail2ban#

fail2ban reads the SSH log and blocks an IP address for a while after too many failed logins.

Install it:

sudo apt update
sudo apt install fail2ban

Put your own settings in jail.local, not in jail.conf (that file is replaced on updates):
```
sudo nano /etc/fail2ban/jail.local
```
```
[DEFAULT]
# Never block these addresses. Add your own fixed IP address if you have one.
ignoreip = 127.0.0.1/8 ::1

[sshd]
enabled = true
backend = systemd
maxretry = 5
findtime = 10m
bantime = 1h
```
With these values, an address that fails 5 times within 10 minutes is blocked for 1 hour. backend = systemd makes fail2ban read the system journal, which also works on Debian 12, where /var/log/auth.log does not exist by default.

Restart fail2ban and check that the SSH jail runs:

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

If you blocked yourself, unblock your address from another connection (or the web console of your provider):
```
sudo fail2ban-client set sshd unbanip 203.0.113.10
```
Replace 203.0.113.10 with your own IP address.

Allow SSH in your firewall#

If you use a firewall, allow SSH before you turn it on, or you lock yourself out. See set up a firewall with ufw.

Keep SSH up to date#

Security fixes for OpenSSH come as normal package updates. See automatic security updates on Ubuntu and Debian.