Secure SSH – Keys, Change Port & Disable Root Login

Quick answer: Secure SSH in 3 steps: set up Ed25519 key → disable password login → optionally change port + Fail2ban. Always test keys in a second terminal before closing your session.

If you landed here: You want to stop brute-force attacks on port 22 or heard password login is insecure.

Step 1: Generate SSH key (local)

ssh-keygen -t ed25519 -C "nexorahost-server"
cat ~/.ssh/id_ed25519.pub

Step 2: Add key on server

mkdir -p ~/.ssh && chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Step 3: Harden sshd_config

PasswordAuthentication no
PermitRootLogin prohibit-password
systemctl restart sshd

UFW: allow new port before closing old → Firewall guide

Part of VPS setup: Set up Linux VPS · Fail2ban

Products & ordering: Root/VPS server · Manage: panel.nexorahost.de · My account · nexorahost.com (Frankfurt · 1 Tbit/s DDoS · 99.9% uptime)