If you rent a VPS (Virtual Private Server) from DigitalOcean, AWS, or Linode, within minutes of the server coming online, it will be bombarded by automated botnets. These scripts endlessly scan the internet, attempting to brute-force their way into port 22 (SSH) by guessing thousands of common passwords (like admin123, root, or password) every single second.
If your password is weak, your server will be compromised, absorbed into a botnet, and used to mine cryptocurrency or launch DDoS attacks. The only way to achieve absolute security against brute-force attacks is to completely disable password logins entirely, forcing the server to only accept cryptographic SSH Key pairs.
Prerequisite: Set Up SSH Keys
CRITICAL WARNING: Do not proceed with this guide unless you have already generated an SSH Key pair on your local computer and successfully added your public key to the server’s ~/.ssh/authorized_keys file. If you disable password authentication before configuring your keys, you will be permanently locked out of your own server.
Test your connection first. If you can type ssh user@your_server_ip and log in without being prompted for a password, it is safe to proceed.
Step 1: Open the SSH Daemon Configuration File
The rules governing SSH connections are stored in a single configuration file.
- Log into your server via SSH.
- Open the configuration file using a text editor with root privileges (we will use nano):
sudo nano /etc/ssh/sshd_config
Step 2: Disable Password Authentication
You need to scan through this long text file and find a very specific line of code.
- In nano, press Ctrl + W (Where Is) to open the search function.
- Type
PasswordAuthenticationand press Enter. - You will likely find a line that says
#PasswordAuthentication yes. The hash symbol (#) means the line is commented out, and the server is relying on its default setting (which allows passwords). - Delete the hash symbol to uncomment the line.
- Change the word “yes” to “no” so the line reads exactly:
PasswordAuthentication no
Step 3: Disable Challenge-Response Authentication (Optional but Recommended)
Some PAM (Pluggable Authentication Modules) can still prompt for keyboard-interactive passwords even if primary password authentication is disabled.
- Use Ctrl + W to search for
ChallengeResponseAuthenticationorKbdInteractiveAuthentication. - Ensure the line is uncommented and set to “no”:
ChallengeResponseAuthentication no
Step 4: Save and Restart the SSH Service
- Save the file and exit the text editor (in nano, press Ctrl+O, Enter, then Ctrl+X).
- To enforce the new security rules, you must restart the SSH daemon:
- On Ubuntu/Debian/Systemd distributions:
sudo systemctl restart ssh - On RHEL/CentOS distributions:
sudo systemctl restart sshd
- On Ubuntu/Debian/Systemd distributions:
Your server is now essentially bulletproof against brute-force attacks. If a bot (or a hacker) attempts to connect to your server without possessing your exact, encrypted private key file, the server will immediately sever the connection without even bothering to ask for a password.