This guide helps you keep your Linux server safe by allowing only trusted people to connect to it via SSH. SSH is like a secure door to your server, and you can control who gets through.
\nWe will show you how to allow only specific computers (by their IP address) to log in, and block everyone else. This helps stop hackers from trying to guess your password.<\/p>\n
Backup command:<\/strong><\/p>\n Disable Root Login <\/span><\/strong><\/p>\n The root account is the most powerful on your server. If hackers guess the password, they can take full control. Disabling root login adds a big layer of security.<\/span><\/p>\n Note: You can still log in as root using sudo after logging in as a regular user.<\/li>\n<\/ol>\n Change the SSH Default Port <\/span><\/strong><\/p>\n Port 22 is the most targeted port by hackers. Changing it to something like 2222 or 4444 makes your server less visible to automated attacks. <\/span><\/p>\n Important: Ensure your firewall allows the new port!<\/li>\n Method 1: Use the SSH Settings File (Best for All Systems)<\/strong> Option A: Allow Only Specific Users from Specific IPs<\/strong> Step-by-step:<\/p>\n This means: “Only user John can log in, and only from the computer at 192.168.1.10.”<\/li>\n \u00a0Option B: Use More Advanced Rules (For Complex Needs) Step-by-step:<\/p>\n Method 2: Use TCP Wrappers (Only for Older Systems)<\/strong><\/p>\n Important: This method only works on older Linux systems like CentOS 7. It doesn\u2019t work on modern systems like AlmaLinux 8+, Rocky Linux 8+, or Ubuntu 20.04+. <\/span><\/p>\n If you are using a newer system, skip this method. <\/span><\/p>\n How It Works:<\/p>\n Step-by-step:<\/p>\n This means: “Block everyone except the IPs listed in \/etc\/hosts.allow.”<\/li>\n Method 3: Use a Firewall (Best for Modern Systems) <\/p>\n A firewall controls who can enter, much like a security guard at the door.<\/span><\/p>\n For AlmaLinux, CentOS 8+, or Rocky Linux:<\/span><\/strong><\/p>\n This means: “Allow SSH access only from 192.168.1.10.”<\/span><\/li>\n For Ubuntu or Debian:<\/span><\/strong><\/p>\n It should <\/a>work.<\/li>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n If you get locked out:<\/span><\/p>\n In this manner, your server?is <\/span><\/span>much safer<\/span><\/span>?from hackers.<\/span><\/span> It significantly strengthens SSH security and helps safeguard your server against illegal logins.<\/p>\n Want to secure access in Plesk too? Learn How to restrict IP address for administrator access in Plesk<\/a><\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":" This guide helps you keep your Linux server safe by allowing only trusted people to connect to it via SSH. SSH is like a secure door to your server, and…<\/p>\nsudo cp \/etc\/ssh\/sshd_config \/etc\/ssh\/sshd_config.backup<\/pre>\n
\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n<\/li>\n
PermitRootLogin yes<\/pre>\n<\/li>\n
PermitRootLogin no<\/pre>\n<\/li>\n
sudo systemctl restart sshd<\/pre>\n
\n
#Port 22<\/pre>\n<\/li>\n
Port 2222<\/pre>\n<\/li>\n
sudo systemctl restart sshd<\/pre>\n
sudo firewall-cmd --permanent --add-port=2222\/tcp\r\nsudo firewall-cmd --reload<\/pre>\n<\/li>\n<\/ol>\n
Different methods to restrict SSH Access<\/strong><\/h3>\n
\n<\/span>You can alter the SSH settings to only allow certain people from specific computers.<\/p>\n
\nLet’s say you have a user named John and you only want him to be able to log in from a computer that has the IP address 192.168.1.10, such as your home computer.<\/p>\n\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n<\/li>\n
AllowUsers john@192.168.1.10<\/pre>\n
sudo systemctl restart sshd<\/pre>\n<\/li>\n
\n<\/strong>\u00a0 You can also say:
\n\u00a0 “Allow J<\/span>ohn from 192.168.1.10″
\n<\/span>\u00a0 “But block J<\/span>ohn from all other computers”<\/span><\/p>\n\n
\n
sudo nano \/etc\/ssh\/sshd_config<\/pre>\n<\/li>\n
Match User john Address 192.168.1.10\r\nPasswordAuthentication yes\r\n<\/span>Match User john Address ! 192.168.1.10\r\nDenyUsers john<\/pre>\n\n
\n
sudo systemctl restart sshd<\/pre>\n<\/li>\n<\/ol>\n
\n
\n
sudo nano \/etc\/hosts.allow<\/pre>\n<\/li>\n
sshd: 192.168.1.10<\/pre>\n<\/li>\n
sudo nano \/etc\/hosts.deny<\/pre>\n<\/li>\n
sshd: ALL<\/pre>\n
\n<\/span><\/strong>Modern systems like <\/span>AlmaLinux 8+, Rocky Linux 8+, and Ubuntu 20.04+ do not support TCP wrappers. So we use a firewall instead.<\/span><\/p>\n\n
sudo firewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"192.168.1.10\" service name=\"ssh\" accept'<\/pre>\n
sudo firewall-cmd --reload<\/pre>\n<\/li>\n
sudo firewall-cmd --list-all<\/pre>\n<\/li>\n<\/ol>\n
\n
sudo ufw allow from 192.168.1.10 to any port 22<\/pre>\n<\/li>\n
sudo ufw enable<\/pre>\n<\/li>\n
sudo ufw status verbose<\/pre>\n<\/li>\n<\/ol>\n
How to Test Your Setup?<\/span><\/strong><\/h3>\n
\n
ssh john@your-server-ip\r\n<\/span><\/pre>\n
\nIt should fail or time out.<\/li>\n<\/ol>\nHow to Verify Everything Works Well?<\/span><\/strong><\/h3>\n
\n
sudo sshd -T | grep -i allow<\/pre>\n<\/li>\n
sudo firewall-cmd --list-all<\/pre>\n<\/li>\n
sudo tail -f \/var\/log\/auth.log<\/pre>\n<\/li>\n<\/ol>\n
Best Practices for Everyone<\/strong><\/h3>\n
\n
SSH Access Compatibility by Operating System<\/strong><\/h3>\n
\n
\n<\/span>These modern RHEL-based systems work best with SSH settings + firewall rules.<\/li>\n
\nOlder OS versions where TCP Wrappers are <\/a>still supported, along with normal SSH configuration.<\/li>\n
\nThese Debian-based systems commonly use SSH settings + UFW for access management.<\/li>\n<\/ul>\nTroubleshooting<\/strong><\/h3>\n
\n
sudo cp \/etc\/ssh\/sshd_config.backup<\/span> \/etc\/ssh\/sshd_config<\/span><\/pre>\n<\/li>\nsudo systemctl restart sshd<\/pre>\n<\/li>\n
\n
\nA Linux VPS Hosting<\/a> solution provides full root access and the flexibility needed to manage SSH policies, firewall rules and secure remote administration.<\/div>\n