Setup & operation

How do I stop SSH brute-force attacks?

Short answer

Disable password authentication entirely — brute force against key-based SSH is not possible. Add fail2ban to reduce log noise, and consider moving SSH off port 22 to cut scanner volume by roughly 95%. The strongest option is putting SSH behind WireGuard so it is never exposed to the public internet.

Changing the port is not security by itself, but it is genuinely effective noise reduction: the vast majority of automated scanners only try 22. Combined with key-only authentication, the residual risk is negligible.

The correct end state for a sensitive server is no public SSH listener at all. Bind sshd to a WireGuard interface, and administration requires the tunnel first. Nothing on the public internet can even attempt authentication.

See also: WireGuard · fail2ban