--- title: SSH Hardening to Prevent Brute-Force Attacks | daily.dev description: Four practical techniques for hardening SSH servers against brute-force attacks: lowering MaxTries in sshd_config, deploying Fail2ban to block suspicious IPs... canonical: https://daily.dev/posts/ssh-hardening-to-prevent-brute-force-attacks-8uypqethx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSH Hardening to Prevent Brute-Force Attacks | daily.dev og:description: Four practical techniques for hardening SSH servers against brute-force attacks: lowering MaxTries in sshd_config, deploying Fail2ban to block suspicious IPs... og:url: https://daily.dev/posts/ssh-hardening-to-prevent-brute-force-attacks-8uypqethx og:image: https://api.daily.dev/og/posts/8uyPqethx.png og:image:alt: SSH Hardening to Prevent Brute-Force Attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSH Hardening to Prevent Brute-Force Attacks **[Teleport](https://daily.dev/sources/teleport)** · 5 min read · 0 upvotes · 0 comments ## Summary Four practical techniques for hardening SSH servers against brute-force attacks: lowering MaxTries in sshd_config, deploying Fail2ban to block suspicious IPs based on log patterns, using TCP wrappers (hosts.allow/hosts.deny) to restrict client access, and enabling two-factor authentication via Google Authenticator PAM module or tools like Teleport that support U2F/WebAuthn. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I limit SSH login attempts to prevent brute-force attacks? Reduce the MaxTries value in sshd_config from its default of 6 to a lower number such as 3. Note that authentication attempts include SSH key validation and Kerberos (GSSAPI) checks, not just password entry, so setting MaxTries too low can exhaust attempts before a password prompt even appears. _Sysadmins tightening SSH configs can find more hardening breakdowns like this on daily.dev._ ### How does Fail2ban protect SSH from brute-force attacks? Fail2ban monitors server logs using configuration files called jails, each pairing a regex filter with an action. When the filter detects failed login attempts or suspicious activity, it triggers actions like temporarily blocking the offending IP address or emailing an admin notification. It's preferred over alternatives like DenyHosts for its flexibility. _daily.dev surfaces practical security tooling guides for engineers securing their infrastructure._ ### How do I set up two-factor authentication for SSH with Google Authenticator? Install the libpam-google-authenticator package, add 'auth required pam_google_authenticator.so' to /etc/pam.d/sshd, restart sshd, and set ChallengeResponseAuthentication to yes in sshd_config. Running google_authenticator generates a QR code to scan, after which SSH logins require both a password and a one-time passcode. _Developers implementing SSH 2FA can track related security walkthroughs on daily.dev._ ## Similar posts on daily.dev - [Hardening SSH: Fail2Ban, Nftables & Cloud Firewalls](https://daily.dev/posts/hardening-ssh-fail2ban-nftables-cloud-firewalls-btns6dfx7) · DigitalOcean Community · 1 upvotes · 0 comments - [How to Harden Ubuntu SSH: From static keys to cloud identity](https://daily.dev/posts/how-to-harden-ubuntu-ssh-from-static-keys-to-cloud-identity-so5mcvj7i) · Ubuntu · 0 upvotes · 0 comments - [SSHStalker botnet brute-forces its way onto 7,000 Linux machines](https://daily.dev/posts/sshstalker-botnet-brute-forces-its-way-onto-7-000-linux-machines-d1nrvsgyf) · CSO Online · 14 upvotes · 0 comments - [Linux Server Hardening: What to Do First and Why It Matters](https://daily.dev/posts/linux-server-hardening-what-to-do-first-and-why-it-matters-4tf1eutt4) · Latest Hacking News · 1 upvotes · 0 comments - [Getting started with SSH: Your complete guide to understanding the secure shell](https://daily.dev/posts/getting-started-with-ssh-your-complete-guide-to-understanding-the-secure-shell-kzltkr6dq) · All Things Open · 2 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/ssh-hardening-to-prevent-brute-force-attacks-8uypqethx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSH Hardening to Prevent Brute-Force Attacks","url":"https://daily.dev/posts/ssh-hardening-to-prevent-brute-force-attacks-8uypqethx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ssh-hardening-to-prevent-brute-force-attacks-8uypqethx"},"datePublished":"2026-08-23T12:22:42.930Z","dateModified":"2026-08-23T12:51:11.239Z","description":"Four practical techniques for hardening SSH servers against brute-force attacks: lowering MaxTries in sshd_config, deploying Fail2ban to block suspicious IPs...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ssh-hardening-to-prevent-brute-force-attacks-8uypqethx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,ssh","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SSH Hardening to Prevent Brute-Force Attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ssh-hardening-to-prevent-brute-force-attacks-8uypqethx#faq","mainEntity":[{"@type":"Question","name":"How do I limit SSH login attempts to prevent brute-force attacks?","acceptedAnswer":{"@type":"Answer","text":"Reduce the MaxTries value in sshd_config from its default of 6 to a lower number such as 3. Note that authentication attempts include SSH key validation and Kerberos (GSSAPI) checks, not just password entry, so setting MaxTries too low can exhaust attempts before a password prompt even appears. Sysadmins tightening SSH configs can find more hardening breakdowns like this on daily.dev."}},{"@type":"Question","name":"How does Fail2ban protect SSH from brute-force attacks?","acceptedAnswer":{"@type":"Answer","text":"Fail2ban monitors server logs using configuration files called jails, each pairing a regex filter with an action. When the filter detects failed login attempts or suspicious activity, it triggers actions like temporarily blocking the offending IP address or emailing an admin notification. It's preferred over alternatives like DenyHosts for its flexibility. daily.dev surfaces practical security tooling guides for engineers securing their infrastructure."}},{"@type":"Question","name":"How do I set up two-factor authentication for SSH with Google Authenticator?","acceptedAnswer":{"@type":"Answer","text":"Install the libpam-google-authenticator package, add 'auth required pam_google_authenticator.so' to /etc/pam.d/sshd, restart sshd, and set ChallengeResponseAuthentication to yes in sshd_config. Running google_authenticator generates a QR code to scan, after which SSH logins require both a password and a one-time passcode. Developers implementing SSH 2FA can track related security walkthroughs on daily.dev."}}]} ```