How to stop SSH brute force attacks

The most effective step is to turn off password logins and use SSH keys, because automated guessing then has nothing to guess. After that, limit who can reach the port and ban repeat offenders.

1. Use keys, not passwords

Add your key and confirm that it works first. Then set these in /etc/ssh/sshd_config:

PasswordAuthentication no
PermitRootLogin no

Test and reload, keeping your current session open in case you need to undo it. The service may be called ssh or sshd:

sudo sshd -t && sudo systemctl reload ssh

2. Limit who can connect

If you can, allow SSH only from a VPN or fixed addresses. Moving SSH to another port reduces log noise, but it is not a security control.

3. Ban repeat offenders

fail2ban bans addresses after repeated failures, and can report them to isipsafe at the same time. See the SSH guide if you would rather use a simple script.

4. Block known attackers

Load the blacklist into your firewall with ipset or nftables, so many attackers are dropped before reaching SSH. See who is active now in the SSH attack report.

Check you are not already compromised

If passwords were enabled, search for logins that succeeded:

sudo journalctl -t sshd -t sshd-session | grep 'Accepted'

If you do not recognise one, follow this guide.