GHOSTVPS / Security
Secure SSH access on an Ubuntu VPS
Test a separate administrative account and SSH key before switching off password and root login.
Updated · GhostVPS
Before you start
Ubuntu 24.04 with OpenSSH, sudo access, a Linux/macOS/WSL terminal and a verified recovery route. This is a public-key-only example; do not apply it unchanged to MFA, central authentication or Match-based policies. Keep your current session open. Replace the example IP and default port as needed.
Prepare an administrator account
Use an existing, tested sudo account or create deploy below. If that username already exists, inspect it instead of recreating it. Choose a strong account password when prompted. Confirm the server identity through a trusted fingerprint before sending credentials.
Your VPS · Linux terminal
sudo adduser deploy
sudo usermod -aG sudo deploy
Create a dedicated key on your computer
Choose a new key filename if ghostvps_admin already exists; never overwrite a working key. Set a passphrase. Copy only the .pub public key to the server. Keep the private key on your computer and out of tickets or chat.
Your computer · terminal
ssh-keygen -t ed25519 -f ~/.ssh/ghostvps_admin
ssh-copy-id -i ~/.ssh/ghostvps_admin.pub deploy@203.0.113.10
Prove that key login and sudo work
Open a separate session using the explicit public-key-only command. A private-key passphrase prompt is normal; a server-account password fallback is not allowed by this command. Run sudo -v inside the new session and confirm it succeeds. Stop here if either check fails.
Your computer · terminal
ssh -i ~/.ssh/ghostvps_admin -o PreferredAuthentications=publickey -o PasswordAuthentication=no deploy@203.0.113.10Your VPS · Linux terminal
sudo -v
Create a small SSH configuration snippet
After the preceding checks, create the named snippet only if it does not already exist. Paste the four file lines below. For most OpenSSH settings the first obtained value wins; Ubuntu loads snippets early. Existing earlier snippets or Match rules can change the result, so file contents alone are not proof.
Your VPS · Linux terminal
sudoedit /etc/ssh/sshd_config.d/00-ghostvps-hardening.confFile contents
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
Validate syntax and effective settings
Run the syntax check and inspect the effective settings: public-key authentication must be yes, and password, keyboard-interactive and root login must be no. Do not reload on any syntax error or unexpected setting. If you use Match rules, also evaluate the actual user/address context with sshd -T -C before proceeding.
Your VPS · Linux terminal
sudo /usr/sbin/sshd -t
sudo /usr/sbin/sshd -T | grep -E '^(pubkeyauthentication|passwordauthentication|kbdinteractiveauthentication|permitrootlogin) '
Reload, test again and retain recovery access
Only after successful checks, reload ssh and open another fresh key-based session. Confirm sudo again before closing the original session. If access fails, use the still-open session or verified recovery route to restore the previous settings, validate with sshd -t and reload. This guide changes no firewall rules.
Your VPS · Linux terminal
sudo systemctl reload sshYour computer · terminal
ssh -i ~/.ssh/ghostvps_admin deploy@203.0.113.10
