Skip to content

Secure SSH – Keys, Change Port & Disable Root Login

Secure SSH on VPS/root server: Ed25519 keys, disable password login, change port, PermitRootLogin – without locking yourself out.

Root & VPS

Quick answer: Secure SSH in 3 steps: set up Ed25519 key → disable password login → optionally change port + Fail2ban. Always test keys in a second terminal before closing your session.

If you landed here: You want to stop brute-force attacks on port 22 or heard password login is insecure.

Step 1: Generate SSH key (local)

ssh-keygen -t ed25519 -C "nexorahost-server"
cat ~/.ssh/id_ed25519.pub

Step 2: Add key on server

mkdir -p ~/.ssh && chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Step 3: Harden sshd_config

PasswordAuthentication no
PermitRootLogin prohibit-password
systemctl restart sshd

UFW: allow new port before closing old → Firewall guide

Part of VPS setup: Set up Linux VPS · Fail2ban

Products & ordering: Root/VPS server · Manage: NexoraHost · My account · nexorahost.com (Frankfurt · 1 Tbit/s DDoS · 99.9% uptime)

Frequently asked questions (FAQ)

SSH keys or password – which is more secure?
SSH keys (Ed25519) are much more secure. Disable password login after key setup.
Can hardening SSH lock me out?
Yes – if you disable password login before key works, or close port 22 in UFW. Always keep a second terminal open.
Which SSH port should I use?
Any port above 1024 (e.g. 2222). Obscurity alone isn't enough – keys + Fail2ban matter more.
Previous Configure Root Server Optimally – Performance, Security & Tuning Next SSH Connection Failed – Connection Refused & Timeout

Keep reading

Popular and fresh – not just the oldest guides.

Root & VPS AWS vs Self-Hosted – Cost Comparison 2026 (VPS Germany) AWS vs self-hosted: EC2, RDS, S3, traffic – real cost math. When does a VPS/root server in... Root & VPS Caddy Reverse Proxy VPS – Automatic HTTPS in 5 Minutes Caddy as reverse proxy: automatic Lets Encrypt, Caddyfile, Docker, multiple domains – simp... Root & VPS Set Up CrowdSec on VPS – Modern Firewall Against Bots & Brute Force CrowdSec on a VPS: install, firewall bouncer, SSH/HTTP scenarios – community-powered defen... Root & VPS Docker Compose Production – VPS Setup with SSL & Updates Docker Compose in production: .env, volumes, restart policies, Traefik SSL, backups, updat... Root & VPS Nginx Reverse Proxy 2026 – Ubuntu, SSL, Docker Apps Nginx as reverse proxy: server blocks, Let’s Encrypt, proxy headers, WebSockets, Docker on... Root & VPS Tailscale on a VPS 2026 – Reach Your Server over VPN Tailscale on an Ubuntu VPS: SSH without public 22, subnet router, exit node, vs WireGuard...
More

Explore NexoraHost