SSH is the front door of the server and the first one bots try, from the minute the IP becomes public. Three settings in sshd_config and one key pair remove almost all of the risk; the rest is hygiene.
A password, however long, can be guessed, reused or phished. An ed25519 key never travels over the wire: the server checks a signature while the private half stays on your laptop, protected by a passphrase. Once password login is off, leaked password lists are useless. OpenSSH has refused root logins with a password by default since version 7.0, through prohibit-password, but the simplest rule is to ban root entirely and sign in with a personal account that escalates through sudo.
fail2ban reads the authentication log and adds a temporary firewall rule for every IP that failed several times within a window. It stops slow brute force and cuts the noise. It does not protect you if password logins are still enabled on predictable accounts, because a botnet tries from thousands of IPs, once each. Order matters: keys and no root first, fail2ban as an extra layer. A non-standard port belongs in the same category, since scanning every port takes seconds.
| Directive | Recommended value | What it does |
|---|---|---|
| PasswordAuthentication | no | Accepts keys only; password brute force becomes pointless |
| PermitRootLogin | no | Root cannot log in directly; you sign in as a user and use sudo |
| AllowUsers | deploy admin | Only the listed accounts can open sessions |
| MaxAuthTries | 3 | Limits attempts per connection |
| KbdInteractiveAuthentication | no | Closes the interactive password path as well |
ssh-keygen -t ed25519 -a 100 -C "deploy@example.ro"
ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@example.roPasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
AllowUsers deploy admin
MaxAuthTries 3
LoginGraceTime 30[sshd]
enabled = true
maxretry = 5
findtime = 10m
bantime = 1h
ignoreip = 127.0.0.1/8 203.0.113.10In the first twelve hours after the IP was allocated, the log showed thousands of root login attempts from dozens of countries. With PasswordAuthentication no they all failed instantly, and fail2ban then shrank the log to a few lines a day.
A former contractor still had a key in authorized_keys on five client servers a year after the contract ended. The agency introduced a central list of keys and a monthly check of the file on every machine it manages.
You need a second way in prepared beforehand: a second key kept offline, the console in the provider's panel, or KVM access on a dedicated server. That is why you do not leave passwords enabled as a backup; you use the provider console, which is not exposed to the internet.
Not as a security measure. It reduces log noise and bot load, which helps on a small server, but any scan finds the new port in seconds. If you want quiet, put SSH behind a VPN or restrict the source in the firewall.
For most servers, keys with a passphrase are enough. On critical servers, or when many people have access, a TOTP second factor through PAM adds protection if a laptop is stolen with the key unlocked. Access only through a VPN has a similar effect.
A production server starts getting attacked within minutes of receiving a public IP address, however small the project is. This guide ranks the controls by impact, from SSH access to incident response, with the Romanian rules that apply along the way. Every topic has its own page with a short answer, examples and ready-to-use configuration.