SSH
Secure Shell, the encrypted protocol used to remotely log in to and administer a Linux server. Almost every automated attack against a small VPS starts with SSH, because it is one of the few services left open on nearly every server by default.
How SSH access typically gets abused
Most successful server compromises that start with SSH do not involve breaking the cryptography. They come from weak or reused passwords, keys that were never rotated after an employee left, or a default configuration that still allows root to log in directly. SSH itself is sound; the surrounding configuration is usually where the risk lives.
Hardening SSH without breaking access
The most effective baseline is disabling password authentication in favor of key-based login, turning off direct root login, and restricting which accounts and IP ranges are allowed to connect. None of these changes require replacing SSH, only tightening how it is configured.
Frequently asked questions
Is it safe to leave SSH open to the whole internet?
It is common, but riskier than it needs to be. Combining key-based authentication, a restricted allow list of IPs where possible, and rate limiting through a tool like fail2ban meaningfully reduces exposure without giving up remote access.
Does changing the SSH port make a server secure?
No. It reduces noise from automated scans but is not a security control on its own. It should never be used as a substitute for key-based authentication and a firewall.
Can SSH be disabled entirely?
On some setups, yes, in favor of a provider's own console access, but most teams keep SSH enabled because it is faster for routine administration. Restricting who can use it matters more than removing it.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab