32. Linux and Network Hardening

32.2 SSH Hardening and fail2ban

By Ravindra Bagale · Last updated: 27 September 2026

SSH is the front door of every Linux server. Lock it in this order.

1. Use keys, not passwords. EC2 already gives key login. For your own VM:

ssh-keygen -t ed25519 -C "ravi-laptop"          # on your laptop
ssh-copy-id student@192.168.56.20                # copy the public key

2. Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 30
AllowUsers ec2-user deploy
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2

3. Test and restart:

sudo sshd -t                     # syntax check – no output means OK
sudo service sshd restart
# In a NEW terminal: ssh -i key.pem ec2-user@server  (keep the old one open!)

Changing the SSH port (for example to 2222) only reduces noise in logs; it is not real security on its own.

4. fail2ban bans IPs that fail too many times:

sudo yum install -y fail2ban           # from EPEL on some distributions
sudo tee /etc/fail2ban/jail.local <<'CONF'
[sshd]
enabled  = true
maxretry = 5
findtime = 10m
bantime  = 1h
CONF
sudo systemctl enable fail2ban
sudo service fail2ban start
sudo fail2ban-client status sshd       # shows banned IPs

5. Best of all on AWS: keep port 22 closed and use Session Manager (Chapter 30).