SSH on Ubuntu Server: Security Configuration and Best Practices
Learn how to configure and secure SSH access on Ubuntu Server. Discover how to disable passwords, use cryptographic keys, and shield your environment against intrusions.
Summary
- Cryptographic key-based authentication replaces vulnerable passwords with mathematically secure file pairs.
- Disabling direct access for the root superuser blocks the primary entry point for automated brute-force attacks.
- Changing the default communication port significantly reduces the volume of noise and malicious attempts in system logs.
- Using the Fail2Ban utility protects the server by automatically blocking IP addresses exhibiting suspicious intrusion behavior.
- Strict permission configurations on hidden directory files ensure that only authorized processes read sensitive keys.
Understanding the role of SSH in remote server management
Managing a server that is physically distant requires a completely secure and encrypted communication channel. That is precisely what Secure Shell, universally known as SSH, does in practice: it creates an armored digital tunnel between your personal computer and the remote machine, allowing you to execute commands and transfer files without third parties intercepting data. Within the Ubuntu Server ecosystem, SSH is the standard entry point for any system administration operation. However, leaving factory settings active is equivalent to locking the front door of a house while leaving the key hanging in the lock.
When we install the package that manages the SSH service in Ubuntu, known as OpenSSH Server, the system assumes default configurations focused strictly on initial ease of use. This means anyone on the network can attempt to guess login passwords. In modern systems engineering, initial convenience gives way to structural security. Understanding the operational workflow of SSH—which involves exchanging messages between a client and a server—is the first step toward transforming a vulnerable environment into a digital fortress resistant to automated internet sweeps.
Generating and using cryptographic access keys
The safest way to interact with your Ubuntu Server is to completely abandon traditional passwords in favor of cryptographic key pairs. In practice, this mechanism acts like a special padlock: the public key is stored on the server, while the private key remains strictly under your control on the local computer. When you attempt to connect, the server challenges your computer to prove it possesses the corresponding private key. If the mathematical proof succeeds, access is granted instantly, eliminating password-guessing attacks.
To create this key pair in your local terminal, the ssh-keygen utility is used, typically opting for the modern Ed25519 algorithm due to its high efficiency and security. The basic command for this operation can be executed as follows:
ssh-keygen -t ed25519 -C '[email protected]'After execution, the system prompts for a save location and an optional protection password, called a passphrase, which adds an extra layer of defense if your laptop is stolen. Next, the generated public key must be copied to the Ubuntu server using the command ssh-copy-id user@ip_address. From that moment on, the server will recognize only connections originating from the holder of the corresponding private key.
Hardening the main configuration file
With access keys properly installed and tested, the next critical step is to modify the SSH server configuration file, located at /etc/ssh/sshd_config. This file centralizes all service behavior rules. In practice, editing this file means defining who can enter, where they can enter from, and which authentication methods will be accepted, closing loopholes that attackers routinely exploit on servers exposed to the public internet.
To make changes safely, use a text editor with administrative privileges, such as nano: sudo nano /etc/ssh/sshd_config. Inside this file, fundamental directives need to be carefully adjusted. The table below summarizes the main security directives, their recommended values, and the practical impact of each change on Ubuntu Server's defense posture.
| Configuration Directive | Recommended Value | Practical Security Impact |
|---|---|---|
PermitRootLogin | no | Prevents the supreme administrator user from being accessed directly over the network. |
PasswordAuthentication | no | Completely disables the use of common passwords, requiring cryptographic keys. |
X11Forwarding | no | Disables unnecessary graphical forwarding on infrastructure servers. |
MaxAuthTries | 3 | Limits the number of login attempts before abruptly terminating the connection. |
After saving modifications to the configuration file, it is essential to validate syntax before restarting the service, preventing the server from becoming inaccessible due to typos. The command sudo sshd -t performs this preliminary check. Once everything is correct, the service must be reloaded using the command sudo systemctl restart ssh so that new rules take effect immediately.
Implementing automated defense against attacks with Fail2Ban
Even after disabling password login and hardening server configurations, malicious bots on the internet will keep knocking on your Ubuntu Server's door trying to find vulnerabilities. This incessant bombardment wastes system resources and clutters logs. In practice, the Fail2Ban tool acts as an automated guard: it continuously monitors system activity logs and, upon detecting multiple authentication errors originating from the same IP address, applies a temporary network ban through the integrated firewall.
Installing Fail2Ban on Ubuntu Server is straightforward via the official package manager by running sudo apt update && sudo apt install fail2ban -y. Once installed, the software creates a default configuration file that can be duplicated and customized to specifically monitor the SSH service. Default rules already offer excellent protection against massive brute-force attempts, banning invading IP addresses for configurable periods, such as ten minutes or more.
To verify that the automated guard is functioning correctly and monitoring intrusion attempts against your SSH service, the command sudo fail2ban-client status sshd provides a detailed report. In it, you can view the exact number of IP addresses currently blocked by the defense system. This additional security layer ensures that large-scale automated attacks are neutralized autonomously without requiring constant human intervention.
Operational best practices and final considerations
Securing an Ubuntu Server via SSH is not a one-time event, but rather an ongoing process of maintenance and monitoring. Beyond foundational encryption configurations and attack mitigation, the administrator's operational discipline makes all the difference. Avoiding the sharing of private keys among different people, immediately revoking access for collaborators who leave projects, and keeping the operating system updated with the latest security patch packages form the foundation of a robust and reliable infrastructure.
In summary, hardening remote access transforms a vulnerable server into a resilient environment prepared for corporate or personal use. By replacing weak passwords with cryptographic keys, restricting direct administrative access, and automating defenses with monitoring tools, administrators drastically reduce the attack surface. The rigorous adoption of these practices ensures the integrity, confidentiality, and availability of data hosted on Linux-based infrastructure.