Security

Hardening SSH on a new server

Keys only, no root passwords, a firewall and automatic updates — without locking yourself out.

5 min readReviewed 25 September 2026

Use keys, disable passwords

With your key working, create a drop-in file rather than editing the main configuration:

PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
MaxAuthTries 3

$ sshd -t && systemctl reload ssh     # "sshd" on AlmaLinux/Rocky

Keep your current session open and test a new login in a second terminal before closing it. If anything goes wrong, the KVM console still gets you in.

Firewall

$ apt install ufw
$ ufw allow 22/tcp
$ ufw allow 443/tcp
$ ufw enable

Automatic security updates

$ apt install unattended-upgrades
$ dpkg-reconfigure -plow unattended-upgrades

Add fail2ban if you must keep password logins for another service.

More in Security

Full-disk encryption with remote unlock (LUKS + dropbear)Encrypt your server’s disks and unlock them over SSH at boot, so the key never sits on the drive. Receiving PGP-encrypted emails from usAdd your public key once; every email we send you — credentials included — is encrypted to it.