How to Secure SSH on Ubuntu: Key Authentication, Custom Port and Best Practices Print

SSH is the front door of your Ubuntu server — and on any machine with a public IP, that door is being rattled around the clock. A typical unprotected VPS logs thousands of failed SSH login attempts per day. The good news: three configuration changes make SSH effectively impenetrable. This guide covers key-based authentication, disabling passwords and root login, changing the SSH port, and a few extra layers the pros use.

Step 1 — Generate an SSH key pair

On your local computer (not the server), create a modern ed25519 key:

ssh-keygen -t ed25519 -C "[email protected]"

Press Enter to accept the default location, and add a passphrase if you want an extra layer in case your laptop is ever stolen.

Step 2 — Copy the public key to the server

ssh-copy-id deploy@your_server_ip

This appends your public key to ~/.ssh/authorized_keys on the server. Test with ssh deploy@your_server_ip — you should get in without a password prompt.

Step 3 — Disable password and root logins

Open the SSH daemon configuration:

sudo nano /etc/ssh/sshd_config

Set these directives (uncomment them if needed):

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3

Step 4 — Optionally change the SSH port

Moving SSH off port 22 does not stop a determined attacker, but it removes 99% of the automated noise from your logs. In the same file set for example:

Port 2222

If you use UFW, allow the new port before restarting SSH: sudo ufw allow 2222/tcp.

Step 5 — Validate and restart

sudo sshd -t
sudo systemctl restart ssh

sshd -t checks the file for syntax errors first — a typo in sshd_config plus a restart is the classic way to lock yourself out. Keep your current session open and verify from a new terminal:

ssh -p 2222 deploy@your_server_ip

Extra hardening layers

Install Fail2Ban to automatically ban IPs that probe whatever port SSH lives on. Restrict logins to specific accounts by adding AllowUsers deploy to sshd_config. If only you administer the server and you have a stable IP, limit SSH in the firewall to that source address — the strongest control of all. And for the truly cautious, two-factor authentication via libpam-google-authenticator adds a TOTP code on top of the key.

Related Ubuntu guides

• Initial Ubuntu 24.04 Server Setup Guide: Secure Your New VPS in 10 Steps
• How to Create a Sudo User on Ubuntu 24.04 and Disable Root Login
• How to Set Up UFW Firewall on Ubuntu 24.04: Complete Configuration Guide
• How to Install Fail2Ban on Ubuntu 24.04 to Stop Brute-Force Attacks