Harden SSH on your VPS

This guide is for a VPS or dedicated server you administer, not shared hosting. A wrong SSH change can lock you out. Before editing, confirm provider-console access and keep the current session open.

1. Prove key-based access first

Create a non-root sudo user if you do not already have one. Add your public key only to that user's ~/.ssh/authorized_keys, with permissions appropriate for SSH. Open a second terminal and sign in as that user with the key. Test a command that requires sudo. Do not disable password login until this independent login succeeds.

2. Change one authentication setting at a time

On Ubuntu, review /etc/ssh/sshd_config and any files under /etc/ssh/sshd_config.d/ for overrides. Once key access works, set PasswordAuthentication no; for root, use PermitRootLogin prohibit-password or no according to your recovery plan. Validate syntax with sudo sshd -t before reloading the SSH service. The exact directives are defined in the OpenSSH manual.

3. Verify before ending the original session

Reload SSH using your distribution's service name, then make a new key-based connection. Check that intended users can still sign in and that password authentication is refused. Only then close the original session. If you change the port, update the host firewall first and test the new port separately; a non-default port is not a substitute for keys and patching.

For brute-force noise, add Fail2ban after SSH access is stable. Never give PK Hosting your private key or password.