Securing SSH Access

SSH is the main entry point to your server. Hardening it is one of the most important security steps you can take.

Change the SSH Port (Optional but Recommended)

Edit /etc/ssh/sshd_config and change or add:

Port 2222

Then allow the new port through your firewall and restart SSH:

ufw allow 2222
systemctl restart sshd

Disable Root SSH Login

In /etc/ssh/sshd_config, set:

PermitRootLogin no

Make sure you have a sudo-capable user before doing this.

Disable Password Authentication (Use SSH Keys Instead)

PasswordAuthentication no
PubkeyAuthentication yes

Generate an SSH Key Pair (On Your Local Machine)

ssh-keygen -t ed25519 -C "your@email.com"

Copy Your Public Key to the Server

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@YOUR_SERVER_IP

Restart SSH to Apply All Changes

systemctl restart sshd

Important: Test your SSH key login in a second terminal window before closing your current session, to ensure you do not lock yourself out.