32. Linux and Network Hardening

32.2 SSH Hardening and fail2ban

By Ravindra Bagale · Last updated: 27 September 2026

In short: SSH is the front door of every Linux server.

SSH is the front door of every Linux server. Lock it in this order.

1. Use keys, not passwords. EC2 already gives key login. For your own VM:

ssh-keygen -t ed25519 -C "ravi-laptop"          # on your laptop
ssh-copy-id student@192.168.56.20                # copy the public key

2. Edit /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
LoginGraceTime 30
AllowUsers ec2-user deploy
X11Forwarding no
ClientAliveInterval 300
ClientAliveCountMax 2

3. Test and restart:

sudo sshd -t                     # syntax check – no output means OK
sudo service sshd restart
# In a NEW terminal: ssh -i key.pem ec2-user@server  (keep the old one open!)

Changing the SSH port (for example to 2222) only reduces noise in logs; it is not real security on its own.

4. fail2ban bans IPs that fail too many times:

sudo yum install -y fail2ban           # from EPEL on some distributions
sudo tee /etc/fail2ban/jail.local <<'CONF'
[sshd]
enabled  = true
maxretry = 5
findtime = 10m
bantime  = 1h
CONF
sudo systemctl enable fail2ban
sudo service fail2ban start
sudo fail2ban-client status sshd       # shows banned IPs

5. Best of all on AWS: keep port 22 closed and use Session Manager (Chapter 30).