Generating SSH Keys
Use the Ed25519 algorithm — it's faster and more secure than RSA:
ssh-keygen -t ed25519 -C "your@email.com"
You'll be prompted to choose a path for the key (default is
~/.ssh/id_ed25519) and set a passphrase. A passphrase adds an extra layer of protection: even if someone gains access to the key file, it's useless without the password. For multiple servers, create named keys:ssh-keygen -t ed25519 -f ~/.ssh/vdsok_key
Copying the Key to the Server
The easiest way is to use the
ssh-copy-id utility:ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server-ip
It will automatically add your public key to the
~/.ssh/authorized_keys file on the server. If ssh-copy-id is not available (e.g., on Windows without WSL), copy the contents of the .pub file manually. On the server, add it to ~/.ssh/authorized_keys and make sure the permissions are correct:chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
Disabling Password Authentication
Once the key is set up and you've confirmed you can log in without a password, disable password authentication. Open
/etc/ssh/sshd_config and set:PasswordAuthentication no PubkeyAuthentication yes PermitRootLogin no
Restart SSH:
sudo systemctl restart sshd
Important: don't close your current SSH session until you've verified login in a new terminal window — if something goes wrong, you'll be able to revert the changes.
Changing the Default Port
Port 22 is the first target for scanner bots. Changing the port doesn't make your server invulnerable, but it drastically reduces the number of junk login attempts. In
/etc/ssh/sshd_config, change Port 22 to any free port above 1024, for example Port 2222. Don't forget to open the new port in the firewall before restarting SSH:sudo ufw allow 2222/tcp
After restarting SSH, connect via:
ssh -p 2222 user@server-ip
Make sure the old port 22 is no longer in use and close it in the firewall.
Aliases in SSH Config
Create or edit the
~/.ssh/config file so you don't have to type the full command every time:Host myserver HostName 185.x.x.x User admin Port 2222 IdentityFile ~/.ssh/vdsok_key
Now you can simply connect by typing:
ssh myserver
You can add multiple hosts, use wildcard rules, and set shared options (e.g.,
ServerAliveInterval 60 for all connections). This is especially handy if you work with a dozen servers — no need to remember IPs and ports.Protection with Fail2Ban
Fail2Ban monitors SSH logs and blocks IP addresses after several failed login attempts.
sudo apt install fail2ban
Create the file
/etc/fail2ban/jail.local:[sshd] enabled = true maxretry = 3 bantime = 3600 findtime = 600
Start and verify:
sudo systemctl enable --now fail2ban sudo fail2ban-client status sshd
Combined with a custom port and key-based authentication, Fail2Ban virtually eliminates brute-force attacks.