Most SSH hardening guides give you 30 config options and no sense of priority. Here's what actually matters, in the order I'd do them on a fresh Ubuntu 24.04 server.
1. Key-only auth (but test first)
Generate your key, copy it over, SSH in with the key to confirm it works — then disable passwords. The number of people who lock themselves out by doing this backwards is staggering.
PasswordAuthentication no
ChallengeResponseAuthentication no
2. The cloud-image gotcha
On Ubuntu cloud images (AWS, DigitalOcean, etc.), there's a file at /etc/ssh/sshd_config.d/60-cloudimg-settings.conf that overrides whatever you put in sshd_config. Drop-in files are read alphabetically, first value wins — so 60-cloudimg-settings.conf beats your settings.
The fix: put your hardening in /etc/ssh/sshd_config.d/10-hardening.conf. 10 beats 60. I wrote about this in detail here.
3. Disable root login
PermitRootLogin no
You have sudo. You don't need direct root SSH.
4. Change the port (yes, really)
Security through obscurity isn't security — but moving off port 22 eliminates 99% of automated brute-force noise, which makes your logs readable and fail2ban's job easier.
5. fail2ban with sane defaults
sudo apt install fail2ban
The default SSH jail is fine for most people. Check it's running: sudo fail2ban-client status sshd.
6. Automatic security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
This is the 30-minute emergency version. The full process — 46 checkpoints covering users, firewall, kernel tweaks, file permissions, log monitoring, and more — is in my Linux Server Hardening Checklist. Every command tested on real Ubuntu 22.04 and 24.04 servers.
Or grab the free 7-step emergency lockdown checklist if you just need the essentials right now.
Top comments (0)