How to Harden a Linux VPS: Ed25519 Keys, Disabling Password Auth & Fail2Ban Setup

· 6 min read

Every Linux server exposed to a public IPv4 address is targeted within minutes by automated botnets scanning port 22 for weak passwords. Leaving root password authentication enabled is one of the most critical infrastructure security risks.

1. Generating Modern Ed25519 Cryptographic Keys

TheEd25519algorithm (based on Curve25519) is faster, more compact, and more resistant to side-channel attacks than legacy RSA 2048/4096 keys. Generate a keypair on your workstation:

ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519_server

Copy your public key to the target server usingssh-copy-id:

ssh-copy-id -i ~/.ssh/id_ed25519_server.pub user@twoj-adres-ip

2. Hardening the OpenSSH Daemon (sshd_config)

Open/etc/ssh/sshd_config.d/security.conf(or/etc/ssh/sshd_config) and apply the following security restrictions:

# Wyłączenie logowania bezpośredniego na konto root
PermitRootLogin no

# Całkowity zakaz uwierzytelniania hasłem (tylko klucze publiczne)
PasswordAuthentication no
PermitEmptyPasswords no
PubkeyAuthentication yes

# Ograniczenie liczby prób autoryzacji
MaxAuthTries 3

# Wyłączenie przestarzałych mechanizmów
X11Forwarding no
KbdInteractiveAuthentication no

Before restarting SSH, verify key authentication in a second terminal window, then reload the daemon:

sudo sshd -t && sudo systemctl restart sshd

3. Automated Brute-Force Mitigation with Fail2Ban

Fail2Banmonitors system authentication logs (such as/var/log/auth.log) and automatically bans offending IP addresses at the firewall level (iptables / nftables) after repeated failed login attempts.

Install Fail2Ban on Debian/Ubuntu:

sudo apt update && sudo apt install fail2ban -y

Create a local jail configuration in/etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 22
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 600
bantime = 86400
Security Tip:Settingbantime = 86400bans attacking IPs for 24 hours after just 3 failed login attempts within a 10-minute window.

Also read

Article RSSHosting & tools