How to Secure an Ubuntu Server by Hardening the SSH Daemon Configuration

Secure Shell (SSH) is the standard method for remotely managing Linux servers. By default, the Ubuntu SSH daemon (sshd) is relatively secure, but it is configured for maximum compatibility rather than maximum security. If your server is exposed to the public internet, it will be subjected to automated brute-force attacks within minutes of going live. Hardening your SSH configuration is an essential first step in securing any Ubuntu deployment.

Step 1: Disable Root Login

The most common target for brute-force attacks is the root user, as every Linux system has one. You should never log in directly as root; instead, log in as a standard user and use sudo to escalate privileges.

1. Open the SSH configuration file using a text editor (requires sudo privileges):
   sudo nano /etc/ssh/sshd_config
2. Locate the line that says PermitRootLogin yes (or prohibit-password).
3. Change it to:
   PermitRootLogin no

Step 2: Disable Password Authentication

Passwords can be guessed, stolen, or brute-forced. SSH Keys (using RSA, Ed25519, etc.) are cryptographically secure and practically impossible to crack. Before disabling passwords, ensure you have successfully generated an SSH key pair on your client machine and added the public key to the server’s ~/.ssh/authorized_keys file.

1. In the same sshd_config file, find the line PasswordAuthentication yes (it may be commented out with a #).
2. Uncomment it and change it to:
   PasswordAuthentication no

Step 3: Change the Default SSH Port (Optional but Recommended)

While changing the default port (22) is technically “security through obscurity,” it dramatically reduces the volume of log noise generated by automated botnets scanning the internet for open SSH servers.

1. Find the line #Port 22 in the configuration file.
2. Uncomment it and change it to a high, unused port number, for example:
   Port 22444
3. Crucial Step: Before restarting SSH, ensure you update your firewall (e.g., UFW) to allow traffic on the new port (sudo ufw allow 22444/tcp), or you will lock yourself out of the server.

Step 4: Apply the Changes

Save the file and exit the text editor (in nano, press Ctrl+X, then Y, then Enter). To apply the new security rules, restart the SSH service:

sudo systemctl restart ssh

Warning: Keep your current SSH session open. Open a new terminal window and attempt to log in using your SSH key (and the new port, if you changed it). If you made a configuration error, your current session will remain active, allowing you to fix the issue without being permanently locked out.