How to Secure SSH Access on Your Ubuntu Server

If you run an Ubuntu server—whether it is a home media server in your closet or a cloud instance on DigitalOcean or AWS—you likely manage it remotely using SSH (Secure Shell). By default, SSH is relatively secure, but out-of-the-box configurations leave your server vulnerable to automated “brute force” attacks where bots constantly guess your password until they get in. Hardening your SSH configuration is the most important step in securing any Linux machine.

1. Disable Root Login

The “root” account is the ultimate administrator on Linux. Hackers know this account exists on every system, making it their number one target. You should never log in directly as root; instead, log in as a normal user and use the sudo command.

1. Open your SSH configuration file using the nano text editor:
   sudo nano /etc/ssh/sshd_config
2. Scroll down until you find a line that says PermitRootLogin yes.
3. Change the “yes” to “no” so it reads: PermitRootLogin no

2. Change the Default SSH Port

By default, SSH listens on Port 22. Automated hacking bots scan the entire internet looking exclusively for open Port 22s. Changing this port to a random, high number will dramatically reduce the number of random attacks hitting your server.

1. In that same sshd_config file, look for a line that says #Port 22.
2. Remove the # symbol to uncomment the line.
3. Change 22 to a random number between 1024 and 65535 (e.g., Port 49215).
4. Crucial Step: Before you save this file, ensure your firewall (UFW or cloud provider firewall) allows incoming connections on this new port!

3. Use SSH Keys Instead of Passwords

Passwords can be guessed. Cryptographic keys cannot. Setting up SSH keys involves generating a mathematical lock and key pair; you put the lock on the server and keep the key on your personal computer.

Once you have successfully generated SSH keys and verified you can log in without typing your password, you should disable password logins entirely.

1. In the sshd_config file, find the line PasswordAuthentication yes.
2. Change it to PasswordAuthentication no.

If someone tries to hack your server now, they won’t even be given a password prompt.

Save and Restart SSH

After making these changes in the nano editor, save the file by pressing Ctrl+O, hit Enter, and then press Ctrl+X to exit.

For the changes to take effect, you must restart the SSH service:

sudo systemctl restart ssh

Warning: Do NOT close your current terminal window yet. Open a second terminal window and try logging into your server using your new port (e.g., ssh username@server_ip -p 49215). If you made a mistake and lock yourself out, your first window is still connected and can fix the error!

Conclusion

By disabling root login, shifting the SSH port away from the default, and enforcing cryptographic key authentication, you transform an easily targetable Ubuntu server into a digital fortress that is practically immune to automated hacking attempts.