How to secure SSH access on a public server

Port 22 gets brute-forced within minutes. Key-only auth plus fail2ban and a firewall removes almost all the risk. The practical, in-order setup.

Port 22 on a public IP starts getting brute-forced within minutes of going live. You do not need anything exotic to stop it — key-only authentication plus a rate limiter removes essentially the entire risk. Here is the practical, in-order setup.

1. Use keys, then turn passwords off

Generate a modern key on your local machine and copy it up:

on your laptop

ssh-keygen -t ed25519 -C "you@laptop"
ssh-copy-id user@your-server

Confirm key login works, then disable passwords entirely so brute force has nothing to aim at:

/etc/ssh/sshd_config

PasswordAuthentication no
PermitRootLogin no
KbdInteractiveAuthentication no
# apply
sudo sshd -t && sudo systemctl restart ssh

2. Add fail2ban

fail2ban watches the auth log and temporarily bans IPs that fail repeatedly — it neutralises the noise from bots even with passwords already off:

install + enable

sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban

Create a minimal jail for SSH:

/etc/fail2ban/jail.local

[sshd]
enabled = true
maxretry = 4
bantime = 1h
findtime = 10m

reload + check

sudo systemctl restart fail2ban
sudo fail2ban-client status sshd

3. Should you change the port?

Moving SSH off 22 does not add real security — a scanner finds the new port in seconds — but it does cut log noise dramatically. It is cosmetic, not protective. If you do it, remember to open the new port in the firewall first.

4. Limit who can log in

Restrict SSH to the accounts that actually need it:

allow-list users

# in sshd_config
AllowUsers deploy admin

5. Firewall the rest

Everything except the ports you serve should be closed. See the UFW guide for the full setup; the SSH essentials are:

ufw

sudo ufw allow OpenSSH
sudo ufw enable

The short version

Keys only, passwords and root login off.
fail2ban on the SSH jail.
Firewall closed except for what you serve.
An allow-list of login accounts.

That combination stops the overwhelming majority of attacks against a new server. Every VMHeaven VPS includes rescue mode and panel console, so you can apply it confidently without fear of being locked out.

Frequently asked

Does changing the SSH port improve security?

Not meaningfully — a scanner finds the new port in seconds. It cuts log noise, which is nice, but it is cosmetic, not protective. Key-only auth is what matters.

Is fail2ban still useful if passwords are disabled?

Yes. It bans noisy IPs and reduces log clutter and load from constant scanning, even when key-only auth already blocks them.

What is the minimum effective setup?

Keys only with passwords and root login off, fail2ban on the SSH jail, a firewall closed except for what you serve, and an AllowUsers list.