Securing SSH Access on a VPS in Germany

When you rent a VPS in Germany, one of the first things you’ll do is connect to it remotely. For Linux servers, this almost always happens through SSH (Secure Shell). SSH is the backbone of server management—it allows you to execute commands, configure applications, and manage files from anywhere in the world.

But with this convenience comes risk. SSH ports are constantly scanned by automated bots and malicious actors who look for weak credentials, misconfigurations, or unpatched vulnerabilities. If your SSH is left exposed with default settings, your Germany VPS could quickly become a target for brute-force attacks, ransomware injections, or data theft.

That’s why securing SSH access is not optional—it’s mandatory. In this guide, we’ll explore best practices to protect SSH on your VPS in Germany, step by step.

Why Securing SSH Matters for a Germany VPS

Choosing a Germany VPS from providers like 99RDP already gives you advantages such as low latency in Europe, compliance with EU data regulations, and strong infrastructure. However, no provider can fully protect your server if your SSH configuration is insecure.

Some real-world risks of an insecure SSH setup include:

• Brute-force attacks: Automated scripts attempt thousands of username-password combinations until they succeed.

• Credential theft: If you use weak or reused passwords, attackers can gain access.

• Privilege escalation: Gaining SSH access as a low-privileged user can lead to root-level compromise.

• Data breaches: Once inside, attackers can steal sensitive files, databases, and API keys.

• Malware & Botnets: Compromised VPS machines are often used as botnet nodes for DDoS attacks.

By securing SSH from the start, you reduce these risks significantly.

Step 1: Change the Default SSH Port

By default, SSH listens on port 22. Attackers and bots know this, so they target it heavily. Changing the port won’t make your VPS unhackable, but it helps avoid automated attacks.

1. Edit the SSH configuration file:

   sudo nano /etc/ssh/sshd_config
   

2. Find the line:

   #Port 22
   

3. Replace it with a custom port (e.g., 2222, 20222, etc.):

   Port 20222
   

4. Restart SSH:

   sudo systemctl restart ssh
   

Now, instead of:

ssh user@your-vps-ip

you’ll connect using:

ssh -p 20222 user@your-vps-ip

⚠️ Tip: Make sure your firewall (UFW, iptables, or cloud provider security group) allows the new port before restarting SSH.

Step 2: Disable Root Login

Logging in as root directly is risky. Hackers know that if they crack root’s password, they have full control immediately. A safer approach is:

• Create a new user with sudo privileges.

  adduser secureuser
  usermod -aG sudo secureuser
  

• Disable root SSH login by editing the config file:

  sudo nano /etc/ssh/sshd_config
  

  Find and change:

  PermitRootLogin no
  

• Restart SSH:

  sudo systemctl restart ssh
  

Now, you’ll log in with secureuser and use sudo for admin commands.

Step 3: Use SSH Key Authentication

Passwords can be guessed, but SSH keys are nearly impossible to brute force if generated properly.

1. Generate a key pair on your local machine:

   ssh-keygen -t rsa -b 4096
   

   This creates:

   • A private key (id_rsa) – keep this safe.

   • A public key (id_rsa.pub) – upload this to your server.

2. Copy the public key to your Germany VPS:

   ssh-copy-id -p 20222 secureuser@your-vps-ip
   

   Or manually place it in:

   ~/.ssh/authorized_keys
   

3. Test login:

   ssh -p 20222 secureuser@your-vps-ip
   

4. Disable password authentication:

   sudo nano /etc/ssh/sshd_config
   

   Change:

   PasswordAuthentication no
   

   Restart SSH again.

From now on, only clients with your private key can log in.

Step 4: Install Fail2Ban

Even with strong keys, it’s smart to block repeated login attempts. Fail2Ban monitors SSH logs and bans IPs that try too many failed logins.

1. Install Fail2Ban:

   sudo apt install fail2ban -y
   

2. Copy default config:

   sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
   

3. Enable SSH protection:
   In /etc/fail2ban/jail.local, find [sshd] and enable it with:

   [sshd]
   enabled = true
   port    = 20222
   logpath = /var/log/auth.log
   maxretry = 3
   bantime = 3600
   

4. Restart Fail2Ban:

   sudo systemctl restart fail2ban
   

Now, attackers who guess wrong three times will be banned for an hour.

Step 5: Enable a Firewall

Firewalls add another security layer by limiting access only to trusted ports. On Ubuntu, UFW (Uncomplicated Firewall) makes this easy.

1. Allow SSH on your custom port:

   sudo ufw allow 20222/tcp
   

2. Allow web services (if needed):

   sudo ufw allow 80/tcp
   sudo ufw allow 443/tcp
   

3. Enable firewall:

   sudo ufw enable
   

4. Check status:

   sudo ufw status
   

Only necessary services are now exposed.

Step 6: Use Two-Factor Authentication (2FA)

If you want extra protection, you can enable 2FA for SSH.

1. Install Google Authenticator:

   sudo apt install libpam-google-authenticator -y
   

2. Run setup for your user:

   google-authenticator
   

   Scan the QR code with your phone’s authenticator app.

3. Edit SSH PAM config:

   sudo nano /etc/pam.d/sshd
   

   Add:

   auth required pam_google_authenticator.so
   

4. Edit SSH config:

   sudo nano /etc/ssh/sshd_config
   

   Enable:

   ChallengeResponseAuthentication yes
   

5. Restart SSH.

Now, you’ll need both your SSH key and a 2FA code to log in.

Step 7: Monitor and Audit SSH Logs

Even with protections in place, monitoring is essential. You can check login attempts with:

sudo journalctl -u ssh

Or view authentication logs:

cat /var/log/auth.log

Consider setting up log monitoring tools like logwatch or centralized logging to stay alerted to suspicious activity.

Step 8: Keep Your VPS Updated

Finally, don’t forget regular system updates:

sudo apt update && sudo apt upgrade -y

Security patches often include fixes for SSH vulnerabilities, so staying up to date is critical.

Why Choose a Germany VPS from 99RDP?

At 99RDP, you get more than just a virtual server—you get a secure, high-performance VPS in Germany with:

• Enterprise-grade datacenters in Frankfurt and other major hubs.

• Low latency connections across Europe and beyond.

• Scalable plans for developers, businesses, and traders.

• 24/7 support to help with setup, troubleshooting, and security hardening.

By combining these infrastructure benefits with the SSH security practices we outlined, you’ll have a VPS that’s both fast and safe.

Conclusion

SSH is the lifeline of any Linux-based VPS in Germany, but it’s also one of the most common attack vectors. By changing the default port, disabling root login, using SSH keys, enabling Fail2Ban, configuring a firewall, and even adding two-factor authentication, you can drastically reduce your risk of compromise.

When you host with providers like 99RDP, you already benefit from reliable German infrastructure. By securing SSH properly, you ensure that only you—and not attackers—control your VPS.

A little time spent on SSH security today can save you from massive headaches tomorrow. Secure your Germany VPS now and enjoy safe, uninterrupted performance.