How to Block Brute-Force Attacks and Secure SSH Access

Harden SSH Configuration

Change Default SSH Port: Edit /etc/ssh/sshd_config and set Port 2222 (or another non-standard port). Restart SSH:

systemctl restart sshd

In /etc/ssh/sshd_config, set PermitRootLogin no.

Use Key-Based Authentication:

Generate SSH keys and disable password logins:

ssh-keygen -t ed25519

Set PasswordAuthentication no in sshd_config.

Restrict Users:

Allow only specific users:

AllowUsers alice bob

Rate-Limit Connections:

Use iptables to limit attempts:

iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --set --name SSH
iptables -A INPUT -p tcp --dport 2222 -m state --state NEW -m recent --update --seconds 60 --hitcount 5 --name SSH -j DROP

Firewall Configuration

Allow Trusted IPs Only (UFW):

ufw allow from 192.168.1.0/24 to any port 2222
ufw enable

Install Fail2Ban

Install and configure to monitor SSH logs:

apt install fail2ban

Edit /etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 1h

After Changes:

systemctl reload sshd