How to Secure SSH Access on Your Linux VPS ​

This guide shows you how to protect your VPS from attackers by setting up SSH keys, disabling root login and changing the SSH port.

1. Create SSH key ​

First, create an SSH key pair on your local PC.

Windows (PowerShell) ​

ssh-keygen -t ed25519

ssh-keygen -t ed25519

Linux / macOS (Terminal) ​

ssh-keygen -t ed25519

ssh-keygen -t ed25519

Confirm the default path with Enter and optionally set a passphrase for additional protection.

Two files are created:

• ~/.ssh/id_ed25519 — your private key (never share this!)
• ~/.ssh/id_ed25519.pub — your public key (this goes on the server)

2. Upload public key to the server ​

Linux / macOS ​

ssh-copy-id root@YOUR_SERVER_IP

ssh-copy-id root@YOUR_SERVER_IP

Windows (PowerShell) ​

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR_SERVER_IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

type $env:USERPROFILE\.ssh\id_ed25519.pub | ssh root@YOUR_SERVER_IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

ssh root@YOUR_SERVER_IP

ssh root@YOUR_SERVER_IP

3. Create a new user (optional) ​

Optionally, you can create a separate user instead of logging in as root.

adduser myuser

adduser myuser

Grant the user sudo rights:

usermod -aG sudo myuser

usermod -aG sudo myuser

Copy the SSH key to the new user:

mkdir -p /home/myuser/.ssh
cp ~/.ssh/authorized_keys /home/myuser/.ssh/authorized_keys
chown -R myuser:myuser /home/myuser/.ssh
chmod 700 /home/myuser/.ssh
chmod 600 /home/myuser/.ssh/authorized_keys

mkdir -p /home/myuser/.ssh
cp ~/.ssh/authorized_keys /home/myuser/.ssh/authorized_keys
chown -R myuser:myuser /home/myuser/.ssh
chmod 700 /home/myuser/.ssh
chmod 600 /home/myuser/.ssh/authorized_keys

ssh myuser@YOUR_SERVER_IP

ssh myuser@YOUR_SERVER_IP

4. Disable root login and password authentication ​

Open the SSH configuration:

sudo nano /etc/ssh/sshd_config

sudo nano /etc/ssh/sshd_config

Find and change the following line:

PasswordAuthentication no

PasswordAuthentication no

If you created a separate user in step 3, you can also disable root login:

PermitRootLogin no

PermitRootLogin no

Save with Ctrl + O, close with Ctrl + X and restart the SSH service:

sudo systemctl restart sshd

sudo systemctl restart sshd

5. Change SSH port ​

By default SSH runs on port 22. Changing this reduces automated brute-force attacks.

Open the SSH configuration:

sudo nano /etc/ssh/sshd_config

sudo nano /etc/ssh/sshd_config

Find the line #Port 22 and change it to:

Port 2222

Port 2222

If you are using UFW, allow the new port before restarting:

sudo ufw allow 2222/tcp

sudo ufw allow 2222/tcp

Restart the SSH service:

sudo systemctl restart sshd

sudo systemctl restart sshd

From now on, connect with:

ssh -p 2222 root@YOUR_SERVER_IP

ssh -p 2222 root@YOUR_SERVER_IP

Summary ​