Hardening SSH: Change the Port, Disable Root, Enforce Key-Only Login

Lock down SSH in three moves: switch to a non-standard port, block direct root login, and allow key-based auth only.

SSH is the front door to your server. The default setup (port 22, root allowed, passwords allowed) gets hammered by automated scanners every single day. This guide tightens it in three steps. Commands target Ubuntu/Debian, with notes for CentOS/Rocky where they differ.

Before you start: keep a way back in

Every change lives in /etc/ssh/sshdconfig. Never close your current session right after editing it. Open a second terminal, confirm you can log in, and only then close the original. If you fat-finger the config, that old session is your rescue line. Back it up first:

sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

This is the step that matters most. Prove your key works before you turn off passwords — otherwise you can lock yourself out.

On your local machine, generate a key (skip if you already have one) and copy it to the server:

ssh-keygen -t ed25519 -C "your-comment"
ssh-copy-id -p 22 user@your-server-ip

Now open a fresh terminal and log in with the key to confirm it works:

ssh -p 22 user@your-server-ip

If it lets you in without a password, you're clear to continue.

Step 2: Edit sshdconfig

Open the config and set each option:

sudo nano /etc/ssh/sshd_config

Port 2222                       # pick a non-standard port in 1024-65535
PermitRootLogin no              # no direct root logins
PubkeyAuthentication yes        # enable key-based auth
PasswordAuthentication no       # disable passwords (only after keys work!)
AllowUsers deploy admin         # allowlist: only these users may log in

Fill AllowUsers with your own regular accounts, separated by spaces. Changing the port isn't a silver bullet, but it cuts a huge amount of brute-force noise from your logs.

Step 3: Open the port and restart

After changing the port, both the firewall and SELinux must allow it, or you'll be locked out on restart.

Firewall (ufw on Ubuntu/Debian):

sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp    # drop the old rule once the new port works

On CentOS/Rocky, use firewalld:

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

SELinux (on by default on CentOS/Rocky; usually not present on Ubuntu/Debian):

sudo semanage port -a -t ssh_port_t -p tcp 2222

If semanage is missing, install policycoreutils-python-utils first.

Restart the SSH service:

sudo systemctl restart ssh

Note: on CentOS/Rocky the service is named sshd:

sudo systemctl restart sshd

Before restarting, validate the syntax with sudo sshd -t — no output means you're good.

Final check

Leave your current session open. From a new terminal, connect on the new port with your key:

ssh -p 2222 user@your-server-ip

If the login succeeds and password auth is refused, the hardening is live — now you can safely close the old session. If your VPS has a control-panel security group or firewall, remember to open the new port there too.

Summary

The right order for SSH hardening is: get key login working, then kill passwords, then change the port and open the firewall. Three settings — PermitRootLogin no, PasswordAuthentication no, and AllowUsers — shut out the overwhelming majority of automated attacks. Keep your current session alive and verify from a fresh terminal at every step, and you'll never lock yourself out.