When managing a remote Linux server, SSH (Secure Shell) is the standard, indispensable network protocol used to log in and issue commands securely. While SSH encrypts all traffic between your local machine and the remote server to prevent eavesdropping, leaving SSH configured with default settings makes your server an easy target for automated bot scans and brute-force attacks.
In fact, within minutes of launching a public server, automated scripts begin scanning Port 22 looking for weak passwords and open root accounts. Today, we will cover how to connect via SSH and the essential security configuration steps to protect your server.
1. What is SSH and How Does It Work?
SSH (Secure Shell) is a cryptographic network protocol operating on Port 22 by default. It creates an encrypted tunnel between an SSH client (your local terminal or PowerShell) and an SSH daemon (sshd) running on the remote server.
Unlike older unencrypted protocols like Telnet, SSH ensures that your login credentials, command execution, and file transfers remain completely secure from interception or tampering over public networks.
2. Basic SSH Connection Methods
Connecting to a Linux server via SSH is straightforward using native command-line tools available on Windows, macOS, and Linux.
Basic SSH Syntax
Bash
ssh username@server_ip_address
- Example:Bash
ssh adminuser@192.0.2.1If connecting for the first time, typeyesto confirm the server’s fingerprint authenticity, then enter your user password.
Connecting via Custom Port
If your server uses a modified SSH port instead of default Port 22, use the -p flag:
Bash
ssh -p 2222 adminuser@192.0.2.1
3. SSH Key-Based Authentication (Stronger Security)
Relying solely on passwords leaves your server vulnerable to brute-force dictionary attacks. SSH Key Authentication uses an asymmetric cryptographic key pair (a Public Key stored on the server and a Private Key stored safely on your PC), offering vastly superior security.
Step 1: Generate an SSH Key Pair (Local Computer)
Open your terminal or PowerShell and run:
Bash
ssh-keygen -t ed25519 -C "your_email@example.com"
(ED25519 is recommended as a modern, high-security algorithm. You can also use ssh-keygen -t rsa -b 4096).
Step 2: Copy the Public Key to the Remote Server
Transfer your public key (~/.ssh/id_ed25519.pub) to the server using ssh-copy-id:
Bash
ssh-copy-id -p 2222 adminuser@192.0.2.1
Once installed, you can log in securely without entering your account password!
4. Essential SSH Security Hardening Steps
After setting up key-based authentication, modify the SSH daemon configuration file (/etc/ssh/sshd_config) on your server to lock down remote access.
Step 1: Edit the SSH Configuration File
Bash
sudo nano /etc/ssh/sshd_config
Step 2: Apply the Following Hardening Directives
① Change the Default SSH Port
Automated scanners continuously probe Port 22. Changing it to a custom port dramatically reduces attack noise.
Plaintext
Port 2222
② Disable Direct Root Login
Prevent attackers from targeting the superuser account directly.
Plaintext
PermitRootLogin no
③ Disable Password Authentication
Require SSH keys for all logins, rendering password-guessing attacks useless.
Plaintext
PasswordAuthentication no
④ Limit Login Attempts
Reduce brute-force risks by dropping connections after a few failed attempts.
Plaintext
MaxAuthTries 3
⑤ Restrict Allowed Users (Optional)
Specify explicitly which user accounts are permitted to connect via SSH:
Plaintext
AllowUsers adminuser developer
Step 3: Test and Restart the SSH Service
Before exiting your active session, restart sshd to apply the changes:
Bash
sudo systemctl restart sshd
IMPORTANT: Keep your existing terminal window open! Open a new terminal tab and test connecting with your SSH key on the new port (
ssh -p 2222 adminuser@server_ip) to verify access before closing the original window.
5. Advanced SSH Security: Using Fail2ban
Even with a custom port, installing an intrusion prevention tool like Fail2ban provides an extra layer of defense. Fail2ban scans SSH log files for repeated failed login attempts and automatically updates your server’s firewall rules to ban offending IP addresses temporarily or permanently.
Installing Fail2ban on Ubuntu/Debian
Bash
sudo apt update && sudo apt install fail2ban -y
sudo systemctl enable fail2ban --now
6. Summary Checklist for SSH Security
Use this quick checklist to audit your server’s SSH posture:
| Security Action | Configuration / Tool | Primary Defense Objective |
| Use SSH Keys | ssh-keygen + ssh-copy-id | Replaces weak passwords with 4096-bit/Ed25519 crypto |
| Change Default Port | Port 2222 in sshd_config | Filters out 99% of automated mass scanners |
| Disable Root Login | PermitRootLogin no | Forces logins through non-root accounts with sudo |
| Disable Password Login | PasswordAuthentication no | Blocks all dictionary and credential stuffing attacks |
| Install Fail2ban | fail2ban service | Automatically bans IPs displaying brute-force behavior |
7. Wrap-up
Securing SSH connection access is the single most effective step you can take to safeguard your Linux server infrastructure.
By disabling direct root logins, implementing SSH key authentication, changing default ports, and disabling password logins, you transform your server from an easy target into a highly resilient, hardened environment!