Dedicated game servers and VPS instances are subjected to uninterrupted automated scanning by distributed botnets. Thousands of compromised machines relentlessly attempt credential brute-force attacks against SSH port 22, targeting accounts like root, admin, steam, or minecraft. A single compromised node results in crypto-miner installations, participation in outbound DDoS floods, and the destruction of multiplayer world saves.
This practical security guide details transitioning server authentication to cryptographic Ed25519 keypairs, disabling password authentication, migrating SSH listening ports, and configuring fail2ban to automatically ban hostile IPs at the firewall level.
Generating Resilient Ed25519 Keypairs#
Password-based logins are inherently vulnerable to dictionary attacks and credential stuffing. Modern Ed25519 elliptic-curve signatures provide optimal cryptographic safety and low verification overhead.
Generate a secure keypair on your local administrative workstation:
ssh-keygen -t ed25519 -C "gamehost-admin"
Transfer the public key component to your remote game server using ssh-copy-id or append it directly to ~/.ssh/authorized_keys.
Auditing Active OpenSSH Daemon Configurations#
Before applying security overrides, inspect the active daemon directives:
sudo grep -E "Port|PermitRootLogin|PasswordAuthentication" /etc/ssh/sshd_config
If PasswordAuthentication evaluates to yes, unauthenticated internet clients can submit endless password guesses against your server.
Authoring an Isolated Hardening Configuration#
To avoid package management merge conflicts during Ubuntu/Debian updates, place hardening rules inside /etc/ssh/sshd_config.d/99-hardened.conf:
Port 2222
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
X11Forwarding no
MaxAuthTries 3
Port 2222— Migrating away from default port 22 eliminates up to 99% of indiscriminate automated botnet scanning.PermitRootLogin no— Blocks administrativerootconnections directly, requiring standard sudo users.PasswordAuthentication no— Forbids interactive cleartext password challenges entirely.
Syntax Validation and Service Reloading#
Never restart OpenSSH without validating syntax, as typographical mistakes can permanently lock operators out of the system:
sudo sshd -t && sudo systemctl restart ssh
If the command completes without errors, keep your existing session active. Open a separate terminal window and verify connectivity via ssh -p 2222 user@server_ip.
Installing and Configuring fail2ban#
The fail2ban service monitors Linux authentication logs in real time and injects drop rules into the firewall whenever an IP exceeds threshold tolerances.
Install fail2ban using the package manager:
sudo apt update && sudo apt install -y fail2ban
Define an application jail override inside /etc/fail2ban/jail.local:
[DEFAULT]
bantime = 86400
findtime = 600
maxretry = 3
banaction = ufw
[sshd]
enabled = true
port = 2222
mode = aggressive
Under this policy, three failed authentication attempts within 10 minutes result in an immediate 24-hour firewall ban (bantime = 86400).
Service Initialization and Jail Auditing#
Enable fail2ban across host reboots and inspect the active sshd jail:
sudo systemctl enable --now fail2ban && sudo fail2ban-client status sshd
The output confirms active log monitoring and displays the list of currently banned IP addresses.
If you prefer operating secure dedicated infrastructure with enterprise game hosting featuring automated OS isolation, DDoS mitigation, and firewall protection, cloud platforms streamline baseline server security out of the box.
