SSH Hardening Checklist for Ubuntu VPS
SSH is the main entry point to your VPS. If SSH is weak, the whole server is weak. This checklist helps website operators reduce common SSH risks without overcomplicating server administration.
What this checklist covers
- Strong authentication
- Root login review
- SSH key usage
- Firewall rules
- Login attempt reduction
- Recovery planning
Checklist
- Create a sudo user for daily administration.
- Use strong passwords or SSH keys.
- Confirm you have VPS console access.
- Consider disabling direct root login after testing sudo access.
- Disable password login only after SSH keys work.
- Allow SSH in the firewall before enabling firewall.
- Install Fail2ban if brute force attempts are common.
- Keep the current SSH session open while testing new access.
- Document the SSH port and recovery method.
- Review auth logs regularly.
Final check
SSH is safer when only trusted users can log in, keys work, firewall allows the correct port and you still have a recovery path if access breaks.
When to Use This Checklist
Use this checklist when securing SSH access on a new or existing Ubuntu VPS for websites or automation systems.
Required Tools
SSH access, Ubuntu VPS, sudo user, VPS provider console, UFW, SSH key pair
Before You Start
Do not disable password login or root login until you confirm your new sudo user and SSH key work in a separate terminal.
Structured Checklist Steps
- Create sudo user.
- Test sudo access.
- Set up SSH key.
- Confirm provider console access.
- Allow SSH in firewall.
- Review root login setting.
- Review password authentication setting.
- Install Fail2ban if needed.
- Check auth log.
- Document recovery method.
Verification Steps
- New sudo user can log in.
- SSH key login works.
- Firewall allows SSH.
- Root login policy is intentional.
- Recovery console is available.
Rollback Plan
If SSH access breaks, use the VPS provider console to restore sshd_config or disable restrictive firewall rules.
Common Mistakes
- Disabling password login before testing SSH keys.
- Closing the only active session too early.
- Blocking SSH with UFW.
- Forgetting provider console access.
- Not documenting custom SSH port.
Related Commands
sudo adduser deploy
sudo usermod -aG sudo deploy
sudo nano /etc/ssh/sshd_config
sudo sshd -t
sudo systemctl reload ssh
sudo ufw allow OpenSSH
sudo tail -n 100 /var/log/auth.log