Hosting providers often deliver a physical or virtual server with direct root access protected only by a password. That is convenient, but it also concentrates all administrative power behind one credential that can be stolen, reused, or guessed. The following procedure replaces that fragile default with a safer SSH access model suitable for most Linux systems.

Routine connections should not use the superuser account. Start by creating an unprivileged account dedicated to administration. The commands below are intended to be run as root immediately after the server becomes available.

useradd semiadmin -b /home -m -U -s /bin/bash

Password authentication is the weakest available option because a password is easy to disclose and can be attacked remotely. Public-key authentication separates the credential into a public key stored on the server and a private key held securely by the administrator. The client proves possession of the private key without transmitting it. Protecting the private key with its own passphrase adds another useful barrier.

mkdir -p /home/semiadmin/.ssh
chown -R semiadmin:semiadmin /home/semiadmin/
    ssh-keygen -t dsa -q -f /home/semiadmin/.ssh/semiadmin_dsa -N "<здесь может быть парль для закрытого ключа>"
cp /home/semiadmin/.ssh/semiadmin_dsa.pub /home/semiadmin/.ssh/authorized_keys
chown semiadmin:semiadmin /home/semiadmin/.ssh/authorized_keys
chmod 600 /home/semiadmin/.ssh/authorized_keys

The key pair can now authenticate the new account. Copy the private key from /home/semiadmin/.ssh/semiadmin_dsa to a secure location, remove the server-side copy, and verify that a new SSH session can be opened with the saved key before changing any daemon settings.

The account can connect safely but still cannot administer the system. Install sudo and edit its policy with visudo.

Add the following line at the end:

semiadmin    ALL=(ALL) NOPASSWD:ALL

This permits the account to use sudo without entering a password. Environments that require another authentication step should omit NOPASSWD and assign a password to the account with passwd instead.

Open a fresh session as the new user and run sudo –i to confirm privileged access. Once that works, edit /etc/ssh/sshd_config and harden the SSH daemon.

Add or update these directives:

Port <<номер порта для доступа к серверу>>
PermitRootLogin no
PubkeyAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
PasswordAuthentication no

The configuration changes the listening port, enables public-key authentication, blocks direct root sessions and empty passwords, and disables password authentication. Restart or reload the SSH service only after confirming that the key-based session works, and keep the existing connection open until the new one succeeds.

These small changes substantially raise the cost of an attack. Administrative access now requires possession of the private key and, when configured, its passphrase rather than a single root password exposed to the network.

If this guide was useful, share it with colleagues and send any corrections or questions.

Reproducing this material on another website without the author’s permission is prohibited.