Hardening SSH access on a Debian server

9 November 2026 · Linux · Debian · SSH

Five simple settings that shut the door on automated attacks against port 22.

A server exposed to the Internet receives SSH login attempts within minutes: bots try root, admin and common passwords. Here are the essentials to protect it.

1. Log in with a key

ssh-keygen -t ed25519
ssh-copy-id noa@server

2. Forbid root and passwords

# /etc/ssh/sshd_config
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3

Before reloading the service, keep a session open and test in a second window: that is what stops you locking yourself out.

sudo sshd -t && sudo systemctl reload ssh

3. Firewall

sudo ufw default deny incoming
sudo ufw allow 22/tcp
sudo ufw logging on
sudo ufw enable

4. Ban persistent attackers

fail2ban reads the logs and temporarily blocks addresses that fail too often.

sudo apt install fail2ban
sudo fail2ban-client status sshd

5. Monitor

The authentication logs show who is trying to get in. A monitoring tool like Zabbix can raise an alert on a spike.

sudo journalctl -u ssh --since today | grep -i failed