[Zero Two]

Every new VPS I spin up goes through this checklist before anything else is deployed. SSH is the most exposed attack surface on a Linux server.

Change the default SSH port (optional but reduces noise)

Code:

# /etc/ssh/sshd_config
Port 2222  # or any non-standard port

This doesn't improve security against targeted attacks but cuts automated scan noise by 90%.

Disable root login

Code:

PermitRootLogin no

Always. SSH in as a regular user and sudo when needed.

Disable password authentication (keys only)

Code:

PasswordAuthentication no
PubkeyAuthentication yes

Do this AFTER you've confirmed key-based login works. Locking yourself out is annoying.

Limit the login grace period

Code:

LoginGraceTime 20
MaxAuthTries 3

Specify allowed users

Code:

AllowUsers yourusername

Only accounts listed here can SSH in.

Disable unused features

Code:

X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no  # unless you need tunnels
PermitTunnel no

Use a modern key algorithm
Generate keys with ssh-keygen -t ed25519. If you have old RSA keys on the server, keep them but prefer ed25519 for new ones.

Install fail2ban

Code:

sudo apt install fail2ban
# Default config jails SSH after 5 failed attempts
sudo systemctl enable --now fail2ban

After all changes:

Code:

sudo sshd -t          # test config syntax before reloading
sudo systemctl reload sshd

Keep your current session open and test login in a new terminal before closing anything. Never reload SSH blind.