Harden SSH in 5 Minutes — A Practical Guide
telegra.ph
Most servers get brute-forced within hours of going online. Here's how to lock down SSH in under 5 minutes. No security degree required. Step 1: Switch to Key-Based Auth (2 min) # On your LOCAL machine, generate a key ssh-keygen -t ed25519 -C "your-email@example.com" # Copy it to the server ssh-copy-id user@your-server # Test it works ssh user@your-server # If you got in without a password prompt, you're good Step 2: Disable Password Auth (1 min) # On the SERVER, edit sshd_config sudo nano /etc/ssh/sshd_config…

Steps I run on every new server. Nothing groundbreaking, just the basics that eliminate 99% of brute force noise:

  1. Generate ed25519 key, copy to server
  2. Disable PasswordAuthentication in sshd_config
  3. Move to a non-standard port
  4. Install fail2ban (3 attempts, 1h ban)
  5. AllowUsers + MaxAuthTries 3

Full commands and config snippets in the writeup. Takes about 5 minutes start to finish.