![\"\"](\"https:\/\/accuweb.cloud\/resource\/wp-content\/uploads\/2026\/07\/Step-1-Change-the-Default-SSH-Port.png\")
<\/a><\/p>\nSave and exit, then restart SSH:<\/p>\n
sudo systemctl restart sshd<\/b><\/p>\n
Important, before you disconnect, make sure your firewall allows the new port (covered in Step 4), otherwise you’ll lock yourself out.<\/p>\n
Step 2: Disable Root Login<\/h3>\n
Letting root log in directly over SSH is risky, if that password or key is ever compromised, the attacker has full access immediately. Instead, log in as a regular user and use sudo when you need elevated access.<\/p>\n
In the same config file:<\/p>\n
sudo vi \/etc\/ssh\/sshd_config<\/b><\/p>\n
Find this line and set it to no:<\/p>\n
PermitRootLogin no<\/b><\/p>\n
Restart SSH again:<\/p>\n sudo systemctl restart sshd<\/b><\/p>\n Make sure you have a non-root user with sudo privileges set up first. If you need to create one:<\/p>\n sudo adduser yourusername<\/b><\/p>\n sudo usermod -aG wheel yourusername<\/b><\/p>\n Passwords can be guessed or brute-forced. SSH keys are far harder to crack and are the standard way to secure production servers.<\/p>\n On your local machine, generate a key pair if you don’t already have one:<\/p>\n ssh-keygen -t ed25519 -C “your_email@example.com”<\/b><\/p>\n Copy your public key to the VPS:<\/p>\n ssh-copy-id -p 2222 yourusername@your_server_ip<\/b><\/p>\n Once you’ve confirmed you can log in using the key, disable password login entirely. Back in the config file:<\/p>\n sudo vi \/etc\/ssh\/sshd_config<\/b><\/p>\n Set:<\/p>\n PasswordAuthentication no<\/b><\/p>\n Restart SSH:<\/p>\n sudo systemctl restart sshd<\/b><\/p>\n From this point on, only devices with the correct private key can log in, no amount of password guessing will work.<\/p>\n AlmaLinux uses firewalld by default. You need to allow your new SSH port and make sure nothing unnecessary is exposed.<\/p>\n Check current status:<\/p>\n sudo firewall-cmd –state<\/b><\/p>\n Allow the new SSH port:<\/p>\n sudo firewall-cmd –permanent –add-port=2222\/tcp<\/b><\/p>\n Remove the default port 22 if it’s open:<\/p>\n sudo firewall-cmd –permanent –remove-service=ssh<\/b><\/p>\n Reload to apply changes:<\/p>\n sudo firewall-cmd –reload<\/b><\/p>\n Verify what’s currently allowed:<\/p>\n sudo firewall-cmd –list-all<\/b><\/p>\n Fail2Ban automatically blocks IP addresses that show repeated failed login attempts, essentially shutting the door on brute force attacks in real time.<\/p>\n Install it:<\/p>\n sudo dnf install epel-release -y<\/b><\/p>\n sudo dnf install fail2ban -y<\/b><\/p>\n Enable and start the service:<\/p>\n sudo systemctl enable fail2ban<\/b><\/p>\n sudo systemctl start fail2ban<\/b><\/p>\n Create a local config so your settings survive updates:<\/p>\n sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/b><\/p>\n sudo vi \/etc\/fail2ban\/jail.local<\/b><\/p>\n Under the [sshd] section, make sure it’s enabled and update the port to match your custom SSH port:<\/p>\n [sshd]<\/b><\/p>\n enabled = true<\/b><\/p>\n port = 2222<\/b><\/p>\n maxretry = 5<\/b><\/p>\n bantime = 3600<\/b><\/p>\n<\/a><\/p>\nStep 3: Switch to SSH Key Authentication<\/h3>\n
<\/a><\/p>\n<\/a><\/p>\nStep 4: Configure the Firewall<\/h3>\n
<\/a><\/p>\nStep 5: Install Fail2Ban<\/h3>\n