How do I harden SSH on a new VPS?

Why harden SSH before anything else?

SSH is the one service every VPS exposes from the first minute, so it is the first door to lock. Password guessing against port 22 starts as soon as an address is live, and a key-only login removes that whole class of attack.

Root over SSH. Paste a public key at checkout and password login stays switched off; leave it empty and the team sets a temporary root password, shown in your dashboard, that you change at first login. If you pasted a key at checkout, password login is already off, and this guide adds the remaining limits. If you got a temporary root password, change it at first login with passwd before you do anything else. According to Gloamport's survey of 10 November 2026, 6 hosts take Monero and ask for no email at sign-up, so on those servers the SSH key and the account number are the only secrets that protect the machine.

How do I create a sudo user and give it my key?

Create the user, add it to sudo, and copy the root account's authorized key to it. Use your key from How do I generate an SSH key for my VPS? if you have not made one yet. Replace admin with the user name you want.

adduser admin
usermod -aG sudo admin
mkdir -p /home/admin/.ssh
cp /root/.ssh/authorized_keys /home/admin/.ssh/authorized_keys
chown -R admin:admin /home/admin/.ssh
chmod 700 /home/admin/.ssh
chmod 600 /home/admin/.ssh/authorized_keys

What goes in the sshd_config drop-in file?

Put the options in one drop-in so a package upgrade never overwrites them. The sshd_config manual says that for most keywords the first value obtained is used, and that Debian's file includes /etc/ssh/sshd_config.d/*.conf at the start, so the prefix 00- makes yours win over files such as a cloud image's own drop-in.

PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
AllowUsers admin
MaxAuthTries 3
LoginGraceTime 30

sshd -t
sshd -T | grep -E "passwordauthentication|permitrootlogin|allowusers"
systemctl restart ssh

Should I change the SSH port or add a firewall?

A different port cuts log noise but adds no real security, so treat it as optional. The manual lets you set it with Port, and multiple Port lines are allowed. If you change it, open the new port in your firewall before you restart ssh. Full KVM virtualization: your own kernel, your own firewall rules and your own disk encryption if you set it up, so you run the firewall that suits you.

Once SSH is tight, the next layers are a private tunnel (How do I set up WireGuard on a VPS?) and an encrypted data volume (Can I encrypt a VPS disk with LUKS?). Dusk, with 2 GB of RAM, is $5.25 a month on 12 months; see the pricing page.