Skip to content
netcupgutscheine.com
← All guides
SSH & hardeningUpdated: 02/11/2026

Netcup SSH hardening: keys, port and Fail2ban

Root access is powerful. This guide shows the order to harden SSH without locking yourself out.

1. Key instead of password

Create an ED25519 key locally and copy the public key to the server. Then disable password login. Test key login in a second session before closing the old one.

ssh-keygen -t ed25519 -a 100 -C "[email protected]"
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]

# On the server:
sudo sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl reload ssh

Note: Open a second SSH session and test key login before closing the first. Otherwise you risk a lockout.

2. Change the port

A different port reduces automated scans but is not a security feature. Open the new port in the SCP and host firewall first, then change sshd_config and restart the service.

# In /etc/ssh/sshd_config:
Port 2222

sudo ufw allow 2222/tcp
sudo sshd -t && sudo systemctl restart ssh
ssh -p 2222 [email protected]

Note: Firewall first, then sshd. If you reverse the order, the new port is blocked.

3. Fail2ban

Fail2ban blocks IPs after repeated failed attempts. For SSH, a jail on auth.log is enough; check the status after starting it.

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

4. Avoid lockout

If you lock yourself out, use the SCP console or rescue system. Keep a backup of sshd_config and a second access path; disable password login only after a successful key test.

  • Test the SCP console and rescue system before you need them.
  • Copy sshd_config before changes.
  • Verify key login in a second session.
  • Root login only with a key, not a password.

Official sources

First server accessPassword, console and first login.Rescue systemAccess after a lockout.SCP firewallOpen ports.Login troubleshootingOfficial troubleshooting.

Matching plans

RS 1000 G12.5

Bestseller
Root server • G12.5
2 Months Free
€21.73/ moincl. 19% VAT12-month term

4 Dedicated Cores (AMD EPYC 9645) · 8 GB RAM · 128 GB NVMe · 2.5 Gbit/s

GB6: 2,290/7,559 · Steal: 0.0 %

Loading current code…

VPS 1000 G12.5

Bestseller
VPS • G12.5
1 Month Free
€14.50/ moincl. 19% VAT12-month term

4 vCores (x86) · 8 GB RAM · 128 GB SSD · 2.5 Gbit/s

GB6: 1,720/4,650 · Steal: 1.2 %

Loading current code…

Frequently asked questions

Which SSH key type should I use?

ED25519 is a good choice for new keys. RSA 4096 still works but is larger and slower. A strong passphrase on the key matters.

Why can I not connect after changing the port?

Usually the SCP or host firewall is missing the new port. Open it first, run sshd -t and restart the service.

Source
How do I recover from a lockout?

Use the SCP console or rescue system to fix sshd_config. Test access before closing the old session.

Source