# How do I harden SSH on a new VPS? > Harden SSH on a new VPS in 6 steps: key-only login, a sudo user, root login off, then sshd -t. Dusk, 2 GB RAM, is $5.25 a month. - URL: https://gloamport.com/guides/how-to-harden-ssh-on-a-vps/ - Last updated: 2026-11-10 - Publisher: Gloamport (https://gloamport.com) Six changes to sshd_config take about ten minutes. Keep your first session open until the last one is tested. **Quick answer — How do I harden SSH on a new VPS?** To harden SSH on a new VPS, create a sudo user, install your public key, then set PasswordAuthentication no, PermitRootLogin no and AllowUsers in a drop-in file under /etc/ssh/sshd_config.d/, check it with sshd -t and reload. Gloamport Dusk, 1 vCPU, 2 GB RAM, 40 GB NVMe, 2 TB traffic, costs $5.25 a month on 12 months. ## Which sshd_config options matter most on a new VPS? | Option | Value | Default in the sshd_config manual | | --- | --- | --- | | `PasswordAuthentication` | `no` | `yes` | | `KbdInteractiveAuthentication` | `no` | `yes` (Debian's file sets `no`) | | `PermitRootLogin` | `no` | `prohibit-password` | | `PubkeyAuthentication` | `yes` | `yes` | | `AllowUsers` | your sudo user | all users | | `MaxAuthTries` | `3` | 6 | | `LoginGraceTime` | `30` | 120 seconds | Defaults as stated in sshd_config(5), checked 2026-11-10. The values in the middle column are this guide's choices. ## Why harden SSH before anything else? SSH is the one service every VPS exposes from the first minute, so it is the first door to lock. Password guessing against port 22 starts as soon as an address is live, and a key-only login removes that whole class of attack. Root over SSH. Paste a public key at checkout and password login stays switched off; leave it empty and the team sets a temporary root password, shown in your dashboard, that you change at first login. If you pasted a key at checkout, password login is already off, and this guide adds the remaining limits. If you got a temporary root password, change it at first login with `passwd` before you do anything else. According to Gloamport's survey of 10 November 2026, 6 hosts take Monero and ask for no email at sign-up, so on those servers the SSH key and the account number are the only secrets that protect the machine. ## How do I harden SSH on a new VPS, step by step? Do them in this order, and keep the first session open until the end. 1. **Create a regular user** — Run adduser and add the user to the sudo group, so you stop working as root. 2. **Install your public key for that user** — Copy your authorized key to the new user, or run ssh-copy-id -i from your own computer. Test the login in a second terminal. 3. **Write a drop-in file** — Create /etc/ssh/sshd_config.d/00-hardening.conf with the options from the table. Debian includes that folder at the start of sshd_config, and the first value for an option wins, so the name must sort early. 4. **Test the configuration** — Run sshd -t. It checks the configuration file and the keys without restarting anything. Run sshd -T to print the effective values. 5. **Reload the service** — Restart ssh and open a new session as the new user before closing the old one. 6. **Confirm root and passwords are refused** — Try to log in as root and with a password from another terminal. Both must fail. ## How do I create a sudo user and give it my key? Create the user, add it to `sudo`, and copy the root account's authorized key to it. Use your key from [How do I generate an SSH key for my VPS?](https://gloamport.com/guides/how-to-generate-an-ssh-key/ "How do I generate an SSH key for my VPS?") if you have not made one yet. Replace `admin` with the user name you want. *Create the user and copy the key (as root)* ```bash adduser admin usermod -aG sudo admin mkdir -p /home/admin/.ssh cp /root/.ssh/authorized_keys /home/admin/.ssh/authorized_keys chown -R admin:admin /home/admin/.ssh chmod 700 /home/admin/.ssh chmod 600 /home/admin/.ssh/authorized_keys ``` ## What goes in the sshd_config drop-in file? Put the options in one drop-in so a package upgrade never overwrites them. The sshd_config manual says that for most keywords the first value obtained is used, and that Debian's file includes `/etc/ssh/sshd_config.d/*.conf` at the start, so the prefix `00-` makes yours win over files such as a cloud image's own drop-in. */etc/ssh/sshd_config.d/00-hardening.conf* ```text PasswordAuthentication no KbdInteractiveAuthentication no PubkeyAuthentication yes PermitRootLogin no AllowUsers admin MaxAuthTries 3 LoginGraceTime 30 ``` *Test, then apply* ```bash sshd -t sshd -T | grep -E "passwordauthentication|permitrootlogin|allowusers" systemctl restart ssh ``` > **Never close your only session** If AllowUsers names a user without your key, you lock yourself out. Keep the first session open, test a second login as the new user, and only then close the first one. sshd -t checks syntax, not whether your key is installed. ## Should I change the SSH port or add a firewall? A different port cuts log noise but adds no real security, so treat it as optional. The manual lets you set it with `Port`, and multiple `Port` lines are allowed. If you change it, open the new port in your firewall before you restart `ssh`. Full KVM virtualization: your own kernel, your own firewall rules and your own disk encryption if you set it up, so you run the firewall that suits you. Once SSH is tight, the next layers are a private tunnel ([How do I set up WireGuard on a VPS?](https://gloamport.com/guides/how-to-set-up-wireguard-on-a-vps/ "How do I set up WireGuard on a VPS?")) and an encrypted data volume ([Can I encrypt a VPS disk with LUKS?](https://gloamport.com/guides/how-to-encrypt-a-vps-disk-with-luks/ "Can I encrypt a VPS disk with LUKS?")). Dusk, with 2 GB of RAM, is $5.25 a month on 12 months; see [the pricing page](https://gloamport.com/pricing/ "How much does a Gloamport VPS cost?"). **In summary** - Work as a sudo user, not as root. - Set `PasswordAuthentication no` and `KbdInteractiveAuthentication no`. - Set `PermitRootLogin no` once the sudo user works. - Use `AllowUsers` to name who may log in. - Put the options in a drop-in whose name sorts first, such as `00-hardening.conf`. - Run `sshd -t` before every restart and keep a second session open. - Dusk costs $5.25 a month on 12 months. ## Hardening SSH on a VPS: common questions ### What does PermitRootLogin prohibit-password mean? It allows root to log in with a key but not with a password. The manual lists it as the default, and `no` goes one step further. ### Why does my change in sshd_config have no effect? The first value for an option wins, and Debian includes the sshd_config.d folder first. An earlier drop-in may set the option, so name yours `00-hardening.conf` and check with `sshd -T`. ### How can I test the config without breaking SSH? Run `sshd -t`, which only checks the configuration file and the keys. Keep a second session open when you restart. ### Do I need to disable password login if I pasted a key at checkout? At Gloamport a pasted key leaves password login off already. Setting the options in a drop-in keeps it that way after upgrades. ### What does MaxAuthTries do? It limits authentication attempts per connection. The manual gives a default of 6, and this guide sets 3. ## Sources 1. [sshd_config(5) manual page](https://manpages.debian.org/trixie/openssh-server/sshd_config.5.en.html) — Debian (checked 2026-11-10) 2. [sshd(8) manual page (-t and -T)](https://manpages.debian.org/trixie/openssh-server/sshd.8.en.html) — Debian (checked 2026-11-10) 3. [ssh-copy-id(1) manual page](https://manpages.debian.org/trixie/openssh-client/ssh-copy-id.1.en.html) — Debian (checked 2026-11-10) --- Gloamport: Gloamport is a VPS provider that sells Linux KVM servers with no KYC, ordered with an account number and paid in crypto, Monero first; it is operated by DomaineGoat LLC, a Panama-registered company. An order asks for a plan, a coin and, only if you want one, an email address: no name, no postal address, no phone and no identity document. On the 12-month term, each plan is priced at least 25% under a named comparable plan from a survey of 38 no-KYC crypto VPS hosts read on 10 November 2026.