DMIT SSH Hardening: From Key Auth to fail2ban

Why harden SSH

SSH is the primary management interface for your DMIT cloud server. Default configurations work but carry security risks: password login is vulnerable to brute force, and the default port 22 attracts heavy scanning traffic. This article covers basic to advanced SSH hardening.

All operations require SSH access. We recommend creating a snapshot before modifying configuration, so you can roll back if something goes wrong.

Step 1: Use SSH key authentication

SSH keys are more secure than passwords — key lengths are typically 2048-4096 bits, making brute force practically impossible.

Generate a key pair

On your local machine (not the server):

ssh-keygen -t ed25519 -C "your_email@example.com"

ed25519 is recommended (shorter, faster, more secure). For legacy systems, use RSA:

ssh-keygen -t rsa -b 4096 -C "your_email@example.com"

Upload the public key

ssh-copy-id root@<server_ip>

Or manually append the public key to the server's ~/.ssh/authorized_keys file.

Verify key login

Open a new terminal and test: ssh root@<server_ip>. Confirm you can log in without a password before proceeding.

Step 2: Disable password login

After confirming key login works, disable password authentication. Edit /etc/ssh/sshd_config:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

Restart SSH: systemctl restart sshd

Do not close your current SSH session — open a new terminal to test login first. Only close the old session after confirming the new config works.

Step 3: Change the default port

Changing SSH from port 22 to another port (e.g. 2222) reduces automated scanning attacks.

# Edit /etc/ssh/sshd_config
Port 2222

Also allow the new port in your firewall:

# iptables
iptables -A INPUT -p tcp --dport 2222 -j ACCEPT

# ufw
ufw allow 2222/tcp

After restarting SSH, connect with the new port: ssh -p 2222 root@<server_ip>

Step 4: Restrict login users

Disable direct root SSH login; use a regular user with sudo instead:

# Create a regular user
adduser deploy
usermod -aG sudo deploy

# After uploading key to deploy, edit sshd_config
PermitRootLogin no
AllowUsers deploy

Step 5: Configure firewall

Allow only necessary ports. Using ufw:

ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp   # SSH (new port)
ufw allow 80/tcp     # HTTP
ufw allow 443/tcp    # HTTPS
ufw enable

If using IPv6, ensure ufw IPv6 rules are configured (edit /etc/default/ufw and set IPV6=yes).

Step 6: Install fail2ban

fail2ban automatically bans IPs with repeated failed logins:

apt update && apt install fail2ban
systemctl enable fail2ban
systemctl start fail2ban

Default config works out of the box (5 failures → 10 min ban). Custom config in /etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600

Additional security tips

• Update regularly: apt update && apt upgrade to install security patches
• Disable unneeded services: use ss -tlnp to check listening ports, close what you don't need
• Use SSH Agent Forwarding: avoids storing private keys on the server
• Set up login notifications: add a notification script to ~/.bashrc
• Audit logs: periodically check /var/log/auth.log

Checklist

For more DMIT guides, see the beginner guide and IPv6 setup guide.

Checked 2026-08-18. SSH configuration details depend on your OS version.