Skip to main content
Use an SSH key and a separate administrator account to reduce unwanted login attempts. This guide gives a worked example for Debian and Ubuntu. Other distributions use different user-management commands and service names.
Keep your current SSH session and the VNC console open until you have tested a new login. Do not disable your only working access method.

​
1. Create an administrator account

In your existing root session, install sudo if needed and create a user. The example uses admin; choose another name if that account already exists.
Choose a strong password for the new user. You will use it for sudo, even after SSH password login is disabled.

​
2. Add your SSH public key

On your own computer, generate a key if you do not already have one:
Protect the private key with a passphrase. Do not overwrite an existing key you still use.
From your computer, copy the public key to the new account. Replace YOUR_VPS_IP:
Enter the new user’s password when asked. If SSH password authentication is already disabled, use the manual method instead.
On the first connection, compare the server’s host-key fingerprint with the one shown through the trusted console. An unexpected changed-key warning should be investigated; do not simply disable host-key checking.

​
3. Test the new account

Open a second terminal on your computer and connect using the key:
Then check administrative access on the VPS:
The last command should print root. If either login or sudo fails, fix it before changing the SSH configuration.

​
4. Disable root and password login

Back up /etc/ssh/sshd_config and any files you will edit in /etc/ssh/sshd_config.d/. Review the Include line and existing settings: OpenSSH generally uses the first value it reads for an option, so adding a conflicting line at the end may not work. On a standard Debian/Ubuntu configuration that includes /etc/ssh/sshd_config.d/*.conf, create an early settings file such as /etc/ssh/sshd_config.d/00-local-access.conf. If that file already exists, review it before editing. Set:
This example uses SSH keys only. If you already use a deliberate multi-factor SSH configuration, do not disable a method required by it. Check the syntax and effective settings:
No output from sshd -t means the syntax check passed. The second command should show the four intended values. Existing Match rules can change settings for particular users or addresses; review those rules too. If the checks pass, reload SSH on Debian/Ubuntu:
Open another fresh SSH connection with the key and repeat the sudo test before closing your original session. If it fails, restore the changed file through the open session or console, run the syntax check and reload again.

​
5. Keep access secure

Install security updates and review recent SSH activity:
Restrict administrative access to trusted source addresses where practical. Follow the UFW guide before enabling new firewall rules. Changing the SSH port can reduce background scanning, but does not replace keys, updates or access restrictions. For distribution-specific details, see Ubuntu’s OpenSSH guide and the OpenSSH configuration reference.