Secure your Linux server

An SSH-hardening and firewall checklist for most distributions (Ubuntu, Debian, RHEL, CentOS and others).

WARNING

Keep an SSH session open while you make changes, and have the server's Console in Flux ready as a fallback. A bad SSH config locks you out.

1. Harden the SSH daemon

Edit /etc/ssh/sshd_config:

sudo vi /etc/ssh/sshd_config

Move SSH to a non-default port

Port 24073

Pick any free port between 1025 and 65535. Off-port reduces brute-force noise.

Disable root login

PermitRootLogin no

TIP

Make sure you have a non-root user with sudo rights before turning this off.

Disable password authentication (key-only login)

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes

WARNING

Test SSH-key login works before flipping this. Use a second SSH session to verify you can still log in.

Limit who can log in

By user:

AllowUsers yourusername

Or by group:

AllowGroups sshusers

Disable empty passwords

PermitEmptyPasswords no

Limit authentication attempts

MaxAuthTries 3
LoginGraceTime 30

Apply the config

Validate first, then reload:

sudo sshd -t
sudo systemctl reload ssh     # Debian / Ubuntu
sudo systemctl reload sshd    # RHEL / CentOS

If sshd -t reports an error, fix it before reloading: reloading a broken config can drop running sessions.

2. Use strong key-based authentication

Generate a modern key on your workstation:

ssh-keygen -t ed25519 -a 100

Avoid RSA-1024 and RSA-2048. Use ed25519, or RSA 4096 only if you need legacy compatibility.

Tighten permissions on the server side once your key is installed:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

3. Put a host firewall in front

Open only the SSH port (whichever you chose above) and whatever else the server actually serves.

UFW (Debian / Ubuntu)

sudo apt install ufw
sudo ufw allow 24073/tcp
sudo ufw enable

firewalld (RHEL / CentOS / Fedora)

sudo firewall-cmd --permanent --add-port=24073/tcp
sudo firewall-cmd --reload

Restrict to a known source IP

If you have a VPN (see WireGuard or Tailscale), scope the firewall rule to your VPN's source address so SSH is only reachable from there.

UFW:

sudo ufw allow from YOUR.VPN.IP.ADDRESS to any port 24073
sudo ufw enable

firewalld:

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="YOUR.VPN.IP.ADDRESS" port protocol="tcp" port="24073" accept'
sudo firewall-cmd --reload

4. Beyond the basics

Consider adding, in roughly this order:

• Automatic security updates (unattended-upgrades on Debian/Ubuntu, dnf-automatic on RHEL/CentOS).
• Fail2ban to ban hosts that fail SSH auth repeatedly.
• Two-factor for SSH with libpam-google-authenticator or hardware keys via OpenSSH 8.2+.
• Centralised logging (rsyslog → remote, or journalctl --upload) so a compromised host cannot erase its tracks.
• Regular host-key audits with ssh-audit to catch deprecated algorithms.

TIP

If the server is reachable on IPv6 too (which Gigahost servers are by default), repeat the firewall rules in the IPv6 chain. UFW does this automatically when you ufw allow, but explicit ip6tables rules need duplicating.