The attacks start immediately
Any server with a public address receives automated SSH login attempts within minutes of coming online. This is constant background noise on the internet, not a sign that anyone is targeting you specifically.
The defences are well established and take a few minutes to apply. Applying them before the server does anything useful is the right order.
Use keys, then disable passwords
Key-based authentication removes the entire category of password-guessing attacks. Generate a key pair, install the public key on the server, verify you can sign in with it, and only then disable password authentication.
Verify first. Disabling password login before confirming key access works is the classic way to lock yourself out of a server.
Do not log in as root
Create an ordinary user with sudo rights and disable direct root login. It means an attacker has to know a username as well as compromise a key, and it makes the audit trail meaningful because actions are attributable.
The settings that matter
- PermitRootLogin no
- PasswordAuthentication no
- PubkeyAuthentication yes
- Limit access to specific users or a group rather than everyone
- Keep the default port unless you have a specific reason to change it; moving it reduces log noise but is not a security control
Reload the SSH service and test in a second session before closing the one you are working in.
Firewall the rest
SSH should be the only management port reachable from the internet, and ideally not even that. Restrict it to known addresses where practical, or place it behind a VPN or the provider’s private networking.
Everything else, including database ports, should be closed to the public internet. Exposed database ports are one of the most common causes of data loss on self-managed servers.
Rate limiting and monitoring
Tools such as fail2ban ban addresses after repeated failures, which cuts log noise substantially. It is not a substitute for key authentication, but it is a reasonable addition.
More usefully, make sure you would notice a successful login you did not make. Reviewing authentication logs occasionally, or shipping them somewhere that alerts, is worth more than another blocking rule.
Keep it patched
Enable automatic security updates. The majority of successful server compromises exploit a known vulnerability with a patch already available, and unattended upgrades close most of that window without ongoing effort.
Related accounts
Accounts on the platforms discussed here: Buy Hetzner Accounts, Buy DigitalOcean Accounts, Buy Linode Accounts.
Related cloud accounts
Accounts on the platforms discussed here, with every configuration and price published up front:
- Buy Hetzner Accounts — from $50.00. German infrastructure, GDPR compliance, strong price to performance.
- Buy DigitalOcean Accounts — from $25.00. Droplets, managed Kubernetes and Spaces.
- Buy Linode Accounts — from $25.00. Akamai-backed compute and SMTP-capable accounts.
Further reading
- DigitalOcean vs Kamatera: Which Cloud Account Should You Buy?
- Where to Rent GPUs: Comparing the Options
- DigitalOcean vs Linode: Which Cloud Account Should You Buy?
- European Cloud Providers and Data Residency
Official documentation
Provider behaviour, quotas and pricing are defined by the platform itself. These are the first-party references for the services discussed above:
Frequently asked questions
It reduces automated log noise but provides no real security benefit. Do it if you want quieter logs, not as a defence.
Not strictly. Key authentication already defeats password guessing. It still helps by reducing log volume.
Most providers offer console access or a rescue mode to add a new key. Keep a backup of the key in a password manager.
