# Secure SSH – Keys, Change Port & Disable Root Login

Secure SSH on VPS/root server: Ed25519 keys, disable password login, change port, PermitRootLogin – without locking yourself out.

**Quick answer:** Secure SSH in 3 steps: set up **Ed25519 key** → **disable password login** → optionally **change port** + Fail2ban. Always test keys in a second terminal before closing your session.

**If you landed here:** You want to stop brute-force attacks on port 22 or heard password login is insecure.

## Step 1: Generate SSH key (local)

`ssh-keygen -t ed25519 -C "nexorahost-server"
cat ~/.ssh/id_ed25519.pub`
## Step 2: Add key on server

`mkdir -p ~/.ssh && chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys`
## Step 3: Harden sshd_config

`PasswordAuthentication no
PermitRootLogin prohibit-password
systemctl restart sshd`
UFW: allow new port before closing old → [Firewall guide](/en/root-v-server/firewall-ports)

Part of VPS setup: [Set up Linux VPS](/en/root-v-server/vps-einrichten) · [Fail2ban](/en/root-v-server/fail2ban)

*Products & ordering: [Root/VPS server](https://nexorahost.com/Dedicated-server) · Manage: [panel.nexorahost.de](https://panel.nexorahost.de) · [My account](https://nexorahost.com/account) · [nexorahost.com](https://nexorahost.com) (Frankfurt · 1 Tbit/s DDoS · 99.9% uptime)*