Four Effective Ways to Stop SSH Brute‑Force Attacks

Overview

SSH brute‑force attacks are common on Linux servers. This guide presents four practical methods to mitigate them: using strong passwords, changing the default SSH port, disabling direct root login and granting sudo rights to a regular user, and configuring key‑based authentication. It also shows how to deploy Fail2ban for automated blocking.

1. Strong Passwords

Use a complex password of at least 16 characters without sequential numbers or letters, and rotate it regularly (e.g., monthly).

2. Change SSH Port

Edit /etc/ssh/sshd_config (line 17) to set a non‑standard port such as 2222, then restart the service.

vim /etc/ssh/sshd_config
# modify Port 2222
systemctl restart sshd

Verify the new port with a scanner (e.g., nmap 127.0.0.1).

3. Disable Direct Root Login and Create a Sudo User

Convert the root account to a system account and create a regular user with sudo privileges.

useradd -s /bin/bash test
passwd --stdin test   # set password
vim /etc/passwd        # ensure UID/GID are appropriate

Test the new account with su - test and check /etc/shadow entries.

4. Key‑Based Authentication

Generate an RSA key pair on the client:

ssh-keygen -t rsa -b 4096
# accept defaults, no passphrase

Copy the public key to the server: ssh-copy-id root@<em>SERVER_IP</em> After the key is installed, log in without a password using ssh <em>SERVER_IP</em>.

5. Install and Configure Fail2ban

Install Fail2ban from EPEL and enable it:

yum install epel-release -y
yum install fail2ban -y
systemctl enable fail2ban.service
systemctl start fail2ban.service

Edit /etc/fail2ban/jail.conf (or create jail.local) to protect SSH:

[ssh-iptables]
enabled = true
filter = sshd
action = iptables[name=SSH,port=ssh,protocol=tcp]
logpath = /var/log/secure
maxretry = 3
findtime = 300
bantime = 3600

Restart Fail2ban and verify status:

systemctl restart fail2ban.service
fail2ban-client status ssh-iptables

Use fail2ban-client set ssh-iptables unbanip <em>IP</em> to remove an IP from the blacklist.

Conclusion

Combining strong passwords, a non‑standard port, restricted root access, key authentication, and Fail2ban provides layered protection against SSH brute‑force attacks.