SSH Best Practices: Disable Root Login and Use SSH Keys

sudo nano /etc/ssh/sshd_config

PermitRootLogin yes

PermitRootLogin no

sudo systemctl restart sshd

Step 2: Use SSH Key Authentication

SSH key pairs offer strong, password-less authentication that is extremely difficult to brute-force.

How to Set Up SSH Keys

On Your Local Machine (Client)

1. Generate a key pair:

ssh-keygen -t rsa -b 4096 -C "[email protected]"

• Press Enter to accept the default path (~/.ssh/id_rsa).
• Set a passphrase for extra security (optional but recommended).

2. Upload the public key to the server:

ssh-copy-id username@your-server-ip

Or manually:

cat ~/.ssh/id_rsa.pub | ssh username@your-server-ip "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"

3. Test your login:

ssh username@your-server-ip

Step 3: Disable Password Authentication (Optional but Recommended)

Once you’ve confirmed key-based login works, disable password login to strengthen SSH root login security and eliminate password-based attacks.

1 Edit the SSH config:

sudo nano /etc/ssh/sshd_config

2. Change or add:

PasswordAuthentication no

3. Restart SSH:

sudo systemctl restart sshd

Your server will now only accept SSH connections using keys.

Additional Tips

• Use Fail2Ban to block repeated failed login attempts.
• Change the default SSH port (22) to a custom port (e.g., 2222) to reduce bot scans.
• Ensure your .ssh folder and files have the correct permissions:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

Summary

By following these SSH best practices, you significantly reduce the risk of unauthorized access to your server infrastructure.

Need assistance implementing this on your servers? Contact our support team.