Dear authorities of educational institutions, teachers, professors, and supervisors, in the era of digital transformation, cybersecurity is no longer an option but a priority necessity. Imagine for a moment academic data, learning materials, or personal student information exposed by a security breach. The server, as the heart of your digital infrastructure, is often the main target for attackers. A single weak point can have serious consequences for the confidentiality, integrity, and availability of your information.
This article is a practical and comprehensive guide to strengthening your SSH server from scratch. Here we reveal step by step how to configure an SSH server resistant to attacks, why each adjustment is important, and how to apply it safely. You will learn to change the default port, disable root access and password authentication, adopt public key authentication, and add defense layers like Fail2Ban and a firewall, in order to minimize the risk of brute force attacks and other threats.
TLDR: Securing SSH is the foundation of server security. Change the default port, disable root login and password, use key authentication, install Fail2Ban, and configure a firewall. These combined measures create effective defense in depth.
What is SSH and why it matters. SSH or Secure Shell is a cryptographic protocol that allows secure remote access to servers over insecure networks. In server management, SSH is used to execute commands and administer systems remotely. Its main feature is that it encrypts all traffic, including usernames, passwords, and command outputs, preventing interception or manipulation by third parties.
In the educational context, servers store grades, academic records, research, and personal data of staff and students. SSH is often the most used administration gateway, which is why it is a frequent target for attacks. The most common intrusion attempts are brute force and dictionary attacks that test massive combinations of credentials. A compromised SSH access allows an attacker to control the server, steal data, install malware, or pivot to other networks.
Initial preparation. First of all, make sure the operating system and packages are updated. On Debian or Ubuntu systems, run the following command from an administration terminal: sudo apt update && sudo apt upgrade -y. If OpenSSH is not installed, install it with: sudo apt install openssh-server -y. After installation, the SSH service usually starts automatically.
Configuring the sshd_config file. The /etc/ssh/sshd_config file centralizes SSH security. Edit it with your preferred editor, for example sudo nano /etc/ssh/sshd_config. The key recommendations are as follows.
Change the default port. The default port 22 is the first target for automated bots. Changing it to a high, uncommon port reduces the volume of attempts. Example: find the line Port 22 and change it to Port 2222 or Port 22022. Always choose ports above 1024 and document the change for your team.
Disable direct root user login. Prevent root from logging in directly via SSH. Configure PermitRootLogin no. This way, administrators log in with a regular user and use sudo for elevated tasks, improving auditing and control.
Disable password authentication. The most effective measure against brute force is disabling PasswordAuthentication. Configure PasswordAuthentication no to force the use of public key authentication, which is much more secure since the private key never travels over the network.
Enable public key authentication. Make sure PubkeyAuthentication is enabled with PubkeyAuthentication yes. This will be the primary method of secure access.
After any change, restart the SSH service with sudo systemctl restart ssh. Important: before restarting, have an alternative active session or access to the physical or virtual console to avoid being locked out due to a configuration error.
SSH key-based authentication. This method uses a key pair, private and public. The public key is placed on the server, and the private key remains secure on the local machine. To generate a key pair on the client, use: ssh-keygen -t rsa -b 4096. It is recommended to protect the private key with a strong passphrase. To copy the public key to the server, you can use ssh-copy-id -i ~/.ssh/id_rsa.pub user@server_ip -p 2222. If ssh-copy-id is not available, you can use it manually: cat ~/.ssh/id_rsa.pub | ssh -p 2222 user@server_ip mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys. Always protect the private key with restrictive permissions using chmod 600 ~/.ssh/id_rsa.
Additional defense measures. For a defense in depth strategy, combine multiple layers of protection.
Limit users and groups. Restrict who can log in by adding AllowUsers or AllowGroups directives in sshd_config. For example: AllowUsers admin another_user or AllowGroups ssh_users. Create the group and add users with commands like sudo addgroup ssh_users and sudo usermod -aG ssh_users username.
Install and configure Fail2Ban. Fail2Ban automatically blocks IPs that show suspicious behavior, such as multiple failed login attempts. Install with sudo apt install fail2ban -y. Copy the base configuration with sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local and edit the sshd section to enable it and adjust the port: [sshd] enabled = true port = 2222 filter = sshd logpath = %(sshd_log)s maxretry = 3 bantime = 1h. Restart Fail2Ban with sudo systemctl restart fail2ban.
Configure firewall. Use UFW or firewalld to allow only necessary traffic. For UFW on Ubuntu, allow your new SSH port and enable the firewall: sudo ufw allow 2222/tcp sudo ufw enable sudo ufw status. Always allow the SSH port before enabling the firewall, or you risk losing access.
Disable X11 forwarding if you don't need it to reduce the attack surface. In sshd_config, set X11Forwarding no.
Continuous maintenance and monitoring. Security is a process, not a one-time task. Regularly review authentication logs located in /var/log/auth.log or /var/log/secure with: sudo tail -f /var/log/auth.log. Consider log analysis tools like Logwatch. Schedule periodic system and OpenSSH updates. Automating security updates via unattended-upgrades on Debian/Ubuntu helps keep critical patches up to date, without forgetting periodic manual reviews.
Integration with services and advanced solutions. For institutions that require more than basic protection, combining these practices with cloud architectures and analytics solutions provides greater resilience. Implementing servers in managed environments with aws and azure cloud services facilitates scaling and the use of native security services. Additionally, integration with business intelligence solutions and tools like power bi allows correlating security events with operational metrics for faster and more actionable response.
About Q2BSTUDIO. Q2BSTUDIO is a company specialized in custom software and application development, with experience in custom software, artificial intelligence, cybersecurity, and aws and azure cloud services. We offer digital transformation services aimed at educational institutions and companies that want to implement secure and scalable solutions. Our team designs AI agents and ai solutions for companies that automate tasks, improve processes, and raise operational security. We also provide business intelligence services and power bi consulting to turn data into strategic decisions.
What Q2BSTUDIO can do for your institution. We audit your infrastructure, implement SSH server hardening, deploy secure architecture in aws and azure cloud services, develop custom applications and custom software solutions integrated with artificial intelligence for early threat detection. We also offer training and knowledge transfer in cybersecurity for your IT team, and we develop AI agents that work alongside staff to optimize operations and security.
Final recommendation. Immediately apply the basic steps: update the system, install OpenSSH, configure sshd_config to change the port, disable root and password, enable key authentication, install Fail2Ban, and configure a firewall. Combine these measures with continuous monitoring and update policies. For more complex projects or if you prefer professional assistance, contact Q2BSTUDIO for a personalized assessment, implementation, and training in cybersecurity and artificial intelligence solutions.
Contact and next step. Protect your institution's digital assets today with a comprehensive strategy that includes custom applications, custom software, artificial intelligence, cybersecurity, aws and azure cloud services, business intelligence services, ai for companies, AI agents, and power bi. Request a consultation with Q2BSTUDIO and turn security into a competitive advantage.
Ready to secure your server and modernize your digital infrastructure with the help of cybersecurity and artificial intelligence experts? Get in touch with Q2BSTUDIO and take the next step towards a safer and more efficient operation.
