⚠️ Golden Rule Before You Start: Always keep a second terminal window open connected to your server while making SSH or firewall adjustments. If you misconfigure a rule, that open session is your lifeline to fix it before you get locked out.

The moment you deploy a brand new virtual server on any cloud host, automated botnets begin probing your IP within fifteen minutes. They look for one thing: a default SSH daemon running on port 22 with password authentication enabled, trying combinations like root and password123.

Securing a server does not require compiling custom kernels or memorizing five hundred iptables tables. In this guide, we will walk through the five foundational defenses every production Linux box needs: creating a safe sudo user, locking SSH behind cryptographic keys, moving off the default port, enforcing firewall rules, and automatically banning persistent brute-force bots with Fail2ban.

Step 1: Create a Limited User and Restrict Root

Logging into your server directly as the root user is dangerous. One mistyped command like rm -rf / can wipe your entire operating system with zero confirmation.

First, log in as root and update your package lists: 

apt update && apt upgrade -y

Next, create a new administrative user. Replace pediaadmin with whatever username you prefer: 

adduser pediaadmin

Add your new user to the sudo group so you can execute administrative commands when needed: 

usermod -aG sudo pediaadmin

Step 2: Generate and Install an SSH Key Pair

Passwords can be guessed, intercepted, or brute-forced. Cryptographic SSH keys (especially Ed25519) cannot. You will generate a key pair on your local computer, copy the public key to the server, and keep the private key safe on your machine.

On your local laptop or workstation terminal, run: 

ssh-keygen -t ed25519 -C "my-server-key"

Hit Enter to accept the default file path, and enter a strong passphrase. Now copy your public key over to your server: 

ssh-copy-id pediaadmin@YOUR_SERVER_IP

Test logging in with your key before continuing: 

ssh pediaadmin@YOUR_SERVER_IP

Step 3: Lock Down the SSH Configuration

Now that your SSH key works, you must tell the SSH daemon to stop accepting passwords and forbid direct root logins completely.

Open the SSH configuration file in nano: 

sudo nano /etc/ssh/sshd_config

Find and update these three settings inside the file: 

# Change port from 22 to a non-standard port to stop 90% of bot sweeps
Port 2222

# Forbid direct root logins
PermitRootLogin no

# Kill password logins (Keys only)
PasswordAuthentication no
PubkeyAuthentication yes

Save and exit (in nano, press Ctrl + O, Enter, then Ctrl + X).

Do not restart SSH yet! If you restart SSH right now without adjusting your firewall in Step 4, your firewall will block port 2222 and lock you out.

Step 4: Enable the UFW Firewall (Default Deny)

Ubuntu and Debian include UFW (Uncomplicated Firewall). It provides a clean, human-friendly front-end over Linux kernel packet filters.

Set a strict default policy: deny every incoming connection, allow all outgoing requests: 

sudo ufw default deny incoming
sudo ufw default allow outgoing

Now explicitly allow your new SSH port (2222) and standard web ports if you run a web server: 

sudo ufw allow 2222/tcp comment 'Custom SSH'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'

Enable the firewall: 

sudo ufw enable

Now you can safely restart the SSH service to apply the new port and security rules: 

sudo systemctl restart ssh

Verify your firewall status: 

sudo ufw status verbose

Step 5: Install Fail2ban to Jail Brute-Force Attackers

Even on non-standard ports, determined attackers may try thousands of password combinations. Fail2ban inspects your authentication log files in real time. If an IP address fails to authenticate five times in ten minutes, Fail2ban updates your firewall to drop all packets from that IP for twenty-four hours.

Install Fail2ban: 

sudo apt install fail2ban -y

Create a local override configuration file so your custom settings survive package updates: 

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Scroll down to the [sshd] section and verify your custom port is defined: 

[sshd]
enabled = true
port = 2222
maxretry = 5
bantime = 1d
findtime = 10m

Restart and enable Fail2ban: 

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

To check how many malicious bots Fail2ban has caught and jailed, run: 

sudo fail2ban-client status sshd

Quick Hardening Cheatsheet

Summary

By completing these five steps, you have elevated your server security past 99% of internet-connected machines. Script kiddies will scan port 22 and find nothing, automated dictionary bots will be rejected by Ed25519 keys, and persistent scanners will get banned by Fail2ban.

Always remember to test your login from a new terminal before closing your active session: ssh -p 2222 pediaadmin@YOUR_SERVER_IP. Happy auditing!