Cantech Cloud

How to Secure the SSH Port in Linux

Written by

Karan Mehta

in

1. Overview

Securing SSH access helps protect your Linux server from unauthorized access and automated attacks.

This guide explains how to secure the SSH service on Ubuntu and AlmaLinux, including operating system-specific commands where required.

2. Change the Default SSH Port

Changing the default SSH port (22) can help reduce automated scanning and attack attempts.

Step 1: Edit the SSH Configuration

Open the SSH configuration file:

Bash
sudo nano /etc/ssh/sshd_config

Locate the following line:

Port 22

Change it to a different port number, for example:

Port 24357

Note: Choose a port number between 1024 and 65535.

Step 2: Restart the SSH Service

Ubuntu

Bash
sudo systemctl restart ssh

AlmaLinux

Bash
sudo systemctl restart sshd

3. Update Firewall Rules

Allow the new SSH port through the firewall before restarting the SSH service.

Ubuntu (UFW)

Bash
sudo ufw allow 24357/tcp
sudo ufw enable

AlmaLinux (firewalld)

Bash
sudo firewall-cmd –permanent –add-port=24357/tcp
sudo firewall-cmd –reload

4. Disable Root Login

Disabling direct root login provides an additional layer of security.

Open the SSH configuration file:

Bash
sudo nano /etc/ssh/sshd_config

Add or update the following setting:

PermitRootLogin no

Restart the SSH service after saving the changes.

5. Use SSH Key Authentication

SSH key authentication is more secure than password-based authentication.

Option A: Use the SSH Key Pair Generated During VM Creation

When creating the Virtual Machine, select the option to generate a new SSH key pair.

A .pem file (for example, MYSSHKey.pem) will be downloaded to your local computer.

Set the correct file permission:

Bash
chmod 400 MYSSHKey.pem

Navigate to the directory containing the key:

Bash
cd Downloads/

Connect to the server using the SSH key:

Bash
ssh -i MYSSHKey.pem root@your-server-ip -p 24357

Note: No password is required when using the .pem file provided during VM creation.

Option B: Generate an SSH Key Pair on Your Local Machine

Generate a new SSH key pair:

Bash
ssh-keygen -t rsa -b 4096

The keys are created in the following locations:
Public key: ~/.ssh/id_rsa.pub
Private key: ~/.ssh/id_rsa
Note: Do not share your private key.

Copy the Public Key to the Server

Run:

Command Prompt
ssh-copy-id -p 24357 root@your-server-ip

Enter the user’s password when prompted.
Alternatively, copy the contents of:

~/.ssh/id_rsa.pub

to:

~/.ssh/authorized_keys

on the remote server.

Set the Correct Permissions

Bash
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Disable Password Authentication

Edit the SSH configuration file:

Bash
sudo nano /etc/ssh/sshd_config

Update the following settings:

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

Restart the SSH service after saving the configuration.

6. Install and Configure Fail2Ban

Fail2Ban helps protect the server from brute-force login attempts.

Install Fail2Ban

Ubuntu

Bash
sudo apt install fail2ban

AlmaLinux

Bash
sudo dnf install epel-release -y
sudo dnf install fail2ban -y

Enable and Start the Service

Bash
sudo systemctl enable fail2ban –now

Configure Fail2Ban (Optional)

Create or edit the following configuration file:

Bash
/etc/fail2ban/jail.local

Enable the SSH jail as required.

More posts