{"id":4921,"date":"2026-08-10T21:49:45","date_gmt":"2026-08-10T21:49:45","guid":{"rendered":"https:\/\/netguide.io\/linux\/ssh-server-absichern\/"},"modified":"2026-08-10T23:41:03","modified_gmt":"2026-08-10T23:41:03","slug":"ssh-server-absichern","status":"publish","type":"post","link":"https:\/\/netguide.io\/linux\/de\/ssh-server-absichern\/","title":{"rendered":"SSH-Server absichern: Port, Root-Login &#038; Fail2ban"},"content":{"rendered":"<script type=\"text\/plain\" data-tcf=\"waiting-for-consent\" data-id=\"4797\" data-bid=\"2\" data-placement=\"4798\">PGRpdiBpZD0ibmV0Z3VpZGVhLTEzNTYwNjEyNTEiIGNsYXNzPSJuZXRndWlkZWEtYmVmb3JlLWNvbnRlbnQgbmV0Z3VpZGVhLWVudGl0eS1wbGFjZW1lbnQiPjxkaXYgY2xhc3M9Im5ldGd1aWRlYS1hZGxhYmVsIj5BZHZlcnRpc2VtZW50czwvZGl2PjxzY3JpcHQgYXN5bmMgc3JjPSIvL3BhZ2VhZDIuZ29vZ2xlc3luZGljYXRpb24uY29tL3BhZ2VhZC9qcy9hZHNieWdvb2dsZS5qcz9jbGllbnQ9Y2EtcHViLTYyNTg1NTYyNTcyNDU5OTgiIGNyb3Nzb3JpZ2luPSJhbm9ueW1vdXMiPjwvc2NyaXB0PjxpbnMgY2xhc3M9ImFkc2J5Z29vZ2xlIiBzdHlsZT0iZGlzcGxheTpibG9jazsiIGRhdGEtYWQtY2xpZW50PSJjYS1wdWItNjI1ODU1NjI1NzI0NTk5OCIgCmRhdGEtYWQtc2xvdD0iMzQ5NDExNTM0MiIgCmRhdGEtYWQtZm9ybWF0PSJhdXRvIj48L2lucz4KPHNjcmlwdD4gCihhZHNieWdvb2dsZSA9IHdpbmRvdy5hZHNieWdvb2dsZSB8fCBbXSkucHVzaCh7fSk7IAo8L3NjcmlwdD4KPC9kaXY+<\/script>\n<p class=\"wp-block-paragraph\">Ein SSH-Server, der aus dem Internet erreichbar ist, wird innerhalb von Minuten von automatisierten Bots attackiert. Mit ein paar gezielten Ma\u00dfnahmen machst du ihn deutlich sicherer. Diese Anleitung zeigt, wie du deinen <strong>SSH-Server absicherst<\/strong>: Key-Login erzwingen, Root-Login und Passw\u00f6rter abschalten, den Port \u00e4ndern und mit Fail2ban Angreifer automatisch aussperren. Mit diesen Schritten zur <strong>SSH-H\u00e4rtung<\/strong> reduzierst du die Angriffsfl\u00e4che deines Servers drastisch \u2013 von der Schl\u00fcssel-Authentifizierung bis zur Firewall.<\/p>\n\n\n\t\t\t\t<div class=\"wp-block-uagb-table-of-contents uagb-toc__align-left uagb-toc__columns-1  uagb-block-1ffd1ad5      \"\n\t\t\t\t\tdata-scroll= \"1\"\n\t\t\t\t\tdata-offset= \"30\"\n\t\t\t\t\tstyle=\"\"\n\t\t\t\t>\n\t\t\t\t<div class=\"uagb-toc__wrap\">\n\t\t\t\t\t\t<div class=\"uagb-toc__title\">\n\t\t\t\t\t\t\tInhaltsverzeichnis\t\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<div class=\"uagb-toc__list-wrap \">\n\t\t\t\t\t\t<ol class=\"uagb-toc__list\"><li class=\"uagb-toc__list\"><a href=\"#warum-ssh-absichern\" class=\"uagb-toc-link__trigger\">Warum SSH absichern?<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-1-ssh-key-statt-passwort\" class=\"uagb-toc-link__trigger\">Schritt 1: SSH-Key statt Passwort<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-2-root-login-und-passwort-login-deaktivieren\" class=\"uagb-toc-link__trigger\">Schritt 2: Root-Login und Passwort-Login deaktivieren<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-3-den-ssh-port-\u00e4ndern-optional\" class=\"uagb-toc-link__trigger\">Schritt 3: Den SSH-Port \u00e4ndern (optional)<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-4-fail2ban-installieren\" class=\"uagb-toc-link__trigger\">Schritt 4: Fail2ban installieren<\/a><li class=\"uagb-toc__list\"><a href=\"#schritt-5-firewall-aktivieren\" class=\"uagb-toc-link__trigger\">Schritt 5: Firewall aktivieren<\/a><li class=\"uagb-toc__list\"><a href=\"#konfiguration-testen-und-neu-laden\" class=\"uagb-toc-link__trigger\">Konfiguration testen und neu laden<\/a><li class=\"uagb-toc__list\"><a href=\"#weitere-sinnvolle-sshd-optionen\" class=\"uagb-toc-link__trigger\">Weitere sinnvolle sshd-Optionen<\/a><li class=\"uagb-toc__list\"><a href=\"#fail2ban-\u00fcberwachen-und-ips-entsperren\" class=\"uagb-toc-link__trigger\">Fail2ban \u00fcberwachen und IPs entsperren<\/a><li class=\"uagb-toc__list\"><a href=\"#diese-fehler-solltest-du-vermeiden\" class=\"uagb-toc-link__trigger\">Diese Fehler solltest du vermeiden<\/a><li class=\"uagb-toc__list\"><a href=\"#h\u00e4ufige-fragen\" class=\"uagb-toc-link__trigger\">H\u00e4ufige Fragen<\/a><li class=\"uagb-toc__list\"><a href=\"#bringt-ein-anderer-ssh-port-mehr-sicherheit\" class=\"uagb-toc-link__trigger\">Bringt ein anderer SSH-Port mehr Sicherheit?<\/a><li class=\"uagb-toc__list\"><a href=\"#wie-entsperre-ich-eine-von-fail2ban-blockierte-ip\" class=\"uagb-toc-link__trigger\">Wie entsperre ich eine von Fail2ban blockierte IP?<\/a><li class=\"uagb-toc__list\"><a href=\"#was-tun-wenn-ich-mich-selbst-ausgesperrt-habe\" class=\"uagb-toc-link__trigger\">Was tun, wenn ich mich selbst ausgesperrt habe?<\/a><li class=\"uagb-toc__list\"><a href=\"#fazit\" class=\"uagb-toc-link__trigger\">Fazit<\/a><\/ol>\t\t\t\t\t<\/div>\n\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Warum SSH absichern?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Standardm\u00e4\u00dfig lauscht SSH auf Port 22 und erlaubt Anmeldungen per Passwort. Genau darauf zielen Brute-Force-Angriffe: Bots probieren im Sekundentakt g\u00e4ngige Benutzernamen und Passw\u00f6rter durch. Ein schwaches Passwort oder ein offener Root-Zugang gen\u00fcgt f\u00fcr eine \u00dcbernahme. Die gute Nachricht: Mit den folgenden Schritten reduzierst du die Angriffsfl\u00e4che drastisch.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 1: SSH-Key statt Passwort<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Die wichtigste Ma\u00dfnahme ist die Anmeldung per SSH-Schl\u00fcssel statt per Passwort. Ein Key l\u00e4sst sich praktisch nicht erraten. Falls du noch keinen hinterlegt hast, folge zuerst unserer Anleitung <a href=\"https:\/\/netguide.io\/linux\/de\/ssh-key-auf-einem-linux-server-hinterlegen\/\">SSH-Key auf einem Linux-Server hinterlegen<\/a>. Stelle sicher, dass der Login per Key funktioniert, <strong>bevor<\/strong> du im n\u00e4chsten Schritt das Passwort deaktivierst \u2013 sonst sperrst du dich aus.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 2: Root-Login und Passwort-Login deaktivieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u00d6ffne die zentrale SSH-Konfigurationsdatei:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo nano \/etc\/ssh\/sshd_config<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> nano<\/span><span style=\"color: #9ECBFF\"> \/etc\/ssh\/sshd_config<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Suche die folgenden Zeilen, entferne ggf. das f\u00fchrende <code>#<\/code> und setze sie auf diese Werte:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>PermitRootLogin no\nPasswordAuthentication no\nPubkeyAuthentication yes\nChallengeResponseAuthentication no<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #E1E4E8\">PermitRootLogin no<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">PasswordAuthentication no<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">PubkeyAuthentication yes<\/span><\/span>\n<span class=\"line\"><span style=\"color: #E1E4E8\">ChallengeResponseAuthentication no<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Damit sind der direkte Root-Login und die Passwort-Anmeldung abgeschaltet. Anmeldungen sind nur noch mit einem g\u00fcltigen Schl\u00fcssel m\u00f6glich.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 3: Den SSH-Port \u00e4ndern (optional)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ein Wechsel weg von Port 22 stoppt keinen gezielten Angreifer, reduziert aber den L\u00e4rm automatisierter Scans erheblich. \u00c4ndere dazu in derselben Datei die Port-Zeile, z. B. auf 2222:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>Port 2222<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #E1E4E8\">Port 2222<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Denk daran, den neuen Port in deiner Firewall freizugeben (siehe Schritt 5) und dich k\u00fcnftig mit <code>ssh -p 2222 benutzer@server<\/code> zu verbinden. Betrachte das aber nur als Erg\u00e4nzung, nicht als echte Sicherheitsma\u00dfnahme.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 4: Fail2ban installieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban durchsucht die Logdateien und sperrt IP-Adressen, die zu viele fehlgeschlagene Anmeldungen produzieren. Installiere es:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo apt update\nsudo apt install -y fail2ban<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> apt<\/span><span style=\"color: #9ECBFF\"> update<\/span><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> apt<\/span><span style=\"color: #9ECBFF\"> install<\/span><span style=\"color: #79B8FF\"> -y<\/span><span style=\"color: #9ECBFF\"> fail2ban<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Lege eine eigene Konfiguration an, damit deine Einstellungen bei Updates erhalten bleiben. Erstelle <code>\/etc\/fail2ban\/jail.local<\/code> mit folgendem Inhalt:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>[sshd]\nenabled = true\nport = 2222\nmaxretry = 4\nbantime = 1h\nfindtime = 10m<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">[sshd]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">enabled<\/span><span style=\"color: #E1E4E8\"> = true<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">port<\/span><span style=\"color: #E1E4E8\"> = 2222<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">maxretry<\/span><span style=\"color: #E1E4E8\"> = 4<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">bantime<\/span><span style=\"color: #E1E4E8\"> = 1h<\/span><\/span>\n<span class=\"line\"><span style=\"color: #F97583\">findtime<\/span><span style=\"color: #E1E4E8\"> = 10m<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Diese Regel sperrt eine IP f\u00fcr eine Stunde, wenn innerhalb von 10 Minuten mehr als vier Fehlversuche auftreten. Passe <code>port<\/code> an deinen SSH-Port an. Aktiviere und starte den Dienst:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo systemctl enable --now fail2ban<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> systemctl<\/span><span style=\"color: #9ECBFF\"> enable<\/span><span style=\"color: #79B8FF\"> --now<\/span><span style=\"color: #9ECBFF\"> fail2ban<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Den aktuellen Status und gesperrte IPs pr\u00fcfst du mit:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo fail2ban-client status sshd<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> fail2ban-client<\/span><span style=\"color: #9ECBFF\"> status<\/span><span style=\"color: #9ECBFF\"> sshd<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Schritt 5: Firewall aktivieren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Eine Firewall schlie\u00dft alle Ports bis auf die, die du wirklich brauchst. Mit der unkomplizierten <code>ufw<\/code> geht das schnell \u2013 gib zuerst deinen SSH-Port frei, sonst sperrst du dich aus (Details in <a href=\"https:\/\/netguide.io\/linux\/de\/ufw-firewall-einrichten-linux\/\">UFW-Firewall einrichten<\/a>):<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo ufw allow 2222\/tcp\nsudo ufw enable<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> ufw<\/span><span style=\"color: #9ECBFF\"> allow<\/span><span style=\"color: #9ECBFF\"> 2222\/tcp<\/span><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> ufw<\/span><span style=\"color: #9ECBFF\"> enable<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Konfiguration testen und neu laden<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pr\u00fcfe die SSH-Konfiguration auf Syntaxfehler und lade den Dienst neu. <strong>Wichtig:<\/strong> Lass deine aktuelle SSH-Sitzung offen und teste den neuen Zugang in einem zweiten Terminal, bevor du sie schlie\u00dft:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>sudo sshd -t          # Konfiguration auf Fehler pr\u00fcfen\nsudo systemctl restart ssh<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color: #24292e\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> sshd<\/span><span style=\"color: #79B8FF\"> -t<\/span><span style=\"color: #6A737D\">          # Konfiguration auf Fehler pr\u00fcfen<\/span><\/span>\n<span class=\"line\"><span style=\"color: #B392F0\">sudo<\/span><span style=\"color: #9ECBFF\"> systemctl<\/span><span style=\"color: #9ECBFF\"> restart<\/span><span style=\"color: #9ECBFF\"> ssh<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Weitere sinnvolle sshd-Optionen<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Neben Key-Login und deaktiviertem Root-Zugang gibt es in der <code>\/etc\/ssh\/sshd_config<\/code> weitere Stellschrauben, mit denen du die Sicherheit erh\u00f6hst. Sie begrenzen Login-Versuche, verk\u00fcrzen Zeitfenster f\u00fcr Angriffe und schr\u00e4nken ein, wer sich \u00fcberhaupt anmelden darf.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Option<\/th><th>Empfehlung<\/th><th>Wirkung<\/th><\/tr><\/thead><tbody><tr><td><code>MaxAuthTries<\/code><\/td><td><code>3<\/code><\/td><td>Begrenzt Fehlversuche pro Verbindung<\/td><\/tr><tr><td><code>LoginGraceTime<\/code><\/td><td><code>30<\/code><\/td><td>Schlie\u00dft h\u00e4ngende Login-Versuche schnell<\/td><\/tr><tr><td><code>AllowUsers<\/code><\/td><td><code>deinname<\/code><\/td><td>Nur genannte Benutzer d\u00fcrfen sich anmelden<\/td><\/tr><tr><td><code>X11Forwarding<\/code><\/td><td><code>no<\/code><\/td><td>Deaktiviert selten ben\u00f6tigtes X-Forwarding<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Trage ge\u00e4nderte Werte in dieselbe Datei ein und lade den Dienst danach neu. Teste jede \u00c4nderung wie gewohnt in einer zweiten Sitzung, bevor du die aktuelle schlie\u00dft.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Fail2ban \u00fcberwachen und IPs entsperren<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Fail2ban arbeitet nach der Einrichtung im Hintergrund, doch du solltest wissen, wie du seinen Status pr\u00fcfst und eine versehentlich gesperrte Adresse wieder freigibst. Den Status des SSH-Jails inklusive der aktuell gebannten IPs zeigt dir <code>fail2ban-client status sshd<\/code>. Hast du dich selbst ausgesperrt, entsperrst du deine Adresse mit <code>fail2ban-client set sshd unbanip DEINE-IP<\/code>.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Status pr\u00fcfen:<\/strong> <code>fail2ban-client status sshd<\/code> listet Treffer und gebannte IPs.<\/li>\n\n<li><strong>IP entsperren:<\/strong> <code>fail2ban-client set sshd unbanip 203.0.113.5<\/code>.<\/li>\n\n<li><strong>Eigene IP sch\u00fctzen:<\/strong> trage sie unter <code>ignoreip<\/code> in der <code>jail.local<\/code> ein.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Diese Fehler solltest du vermeiden<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Die meisten Aussperrungen entstehen durch Fl\u00fcchtigkeitsfehler. Deaktiviere den Passwort-Login niemals, bevor der Key-Login nachweislich funktioniert. \u00c4nderst du den Port, gib ihn zuerst in der Firewall frei \u2013 sonst blockiert <code>ufw<\/code> deine n\u00e4chste Verbindung. Und lade die SSH-Konfiguration erst neu, nachdem <code>sshd -t<\/code> die Syntax ohne Fehler best\u00e4tigt hat. Ein zweiter, wichtiger Grundsatz: Halte immer eine unabh\u00e4ngige Notfall-Konsole (VNC oder KVM deines Anbieters) bereit, damit du dich auch bei einem Fehler in der SSH-Konfiguration wieder Zugriff verschaffen kannst.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">H\u00e4ufige Fragen<\/h3>\n\n\n\n<h3 class=\"wp-block-heading\">Bringt ein anderer SSH-Port mehr Sicherheit?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Nur begrenzt. Ein anderer Port reduziert den L\u00e4rm automatisierter Massenscans sp\u00fcrbar, h\u00e4lt aber keinen gezielten Angreifer auf. Betrachte ihn als Erg\u00e4nzung, nicht als Ersatz f\u00fcr Key-Login und Fail2ban.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Wie entsperre ich eine von Fail2ban blockierte IP?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Mit <code>fail2ban-client set sshd unbanip DEINE-IP<\/code> gibst du eine Adresse sofort wieder frei. Um dich k\u00fcnftig nicht selbst auszusperren, tr\u00e4gst du deine feste IP unter <code>ignoreip<\/code> in der <code>jail.local<\/code> ein.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Was tun, wenn ich mich selbst ausgesperrt habe?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Melde dich \u00fcber die Konsole deines Anbieters (VNC oder KVM) an, die unabh\u00e4ngig von SSH funktioniert. Dort korrigierst du die Konfiguration oder entsperrst deine IP. Deshalb solltest du jede \u00c4nderung immer in einer zweiten Sitzung testen.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Fazit<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Mit Key-Login, deaktiviertem Root- und Passwort-Zugang sowie Fail2ban und einer Firewall ist dein <strong>SSH-Server<\/strong> gegen die \u00fcberwiegende Mehrheit der Angriffe gesch\u00fctzt. Der wichtigste Grundsatz dabei: Teste jeden Schritt in einer zweiten Sitzung, damit du dich nie aussperrst. Wer regelm\u00e4\u00dfig Wartungsaufgaben automatisieren will, kombiniert das gut mit <a href=\"https:\/\/netguide.io\/linux\/de\/cronjobs-linux-crontab-einrichten\/\">Cronjobs per crontab<\/a>.<\/p>\n<script type=\"text\/plain\" data-tcf=\"waiting-for-consent\" data-id=\"4799\" data-bid=\"2\" data-placement=\"4800\">PGRpdiBpZD0ibmV0Z3VpZGVhLTI2MjYwODMwMTEiIGNsYXNzPSJuZXRndWlkZWEtYWZ0ZXItY29udGVudCBuZXRndWlkZWEtZW50aXR5LXBsYWNlbWVudCI+PGRpdiBjbGFzcz0ibmV0Z3VpZGVhLWFkbGFiZWwiPkFkdmVydGlzZW1lbnRzPC9kaXY+PHNjcmlwdCBhc3luYyBzcmM9Ii8vcGFnZWFkMi5nb29nbGVzeW5kaWNhdGlvbi5jb20vcGFnZWFkL2pzL2Fkc2J5Z29vZ2xlLmpzP2NsaWVudD1jYS1wdWItNjI1ODU1NjI1NzI0NTk5OCIgY3Jvc3NvcmlnaW49ImFub255bW91cyI+PC9zY3JpcHQ+PGlucyBjbGFzcz0iYWRzYnlnb29nbGUiIHN0eWxlPSJkaXNwbGF5OmJsb2NrOyIgZGF0YS1hZC1jbGllbnQ9ImNhLXB1Yi02MjU4NTU2MjU3MjQ1OTk4IiAKZGF0YS1hZC1zbG90PSI0NTU5Nzg1MDAyIiAKZGF0YS1hZC1mb3JtYXQ9ImF1dG8iPjwvaW5zPgo8c2NyaXB0PiAKKGFkc2J5Z29vZ2xlID0gd2luZG93LmFkc2J5Z29vZ2xlIHx8IFtdKS5wdXNoKHt9KTsgCjwvc2NyaXB0Pgo8L2Rpdj4=<\/script>","protected":false},"excerpt":{"rendered":"<p>SSH-Server absichern: Key-Login erzwingen, Root-Login und Passw\u00f6rter deaktivieren, den Port \u00e4ndern und mit Fail2ban Brute-Force-Angriffe automatisch blocken.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[9],"tags":[],"class_list":["post-4921","post","type-post","status-publish","format-standard","hentry","category-linux"],"uagb_featured_image_src":{"full":false,"thumbnail":false,"medium":false,"medium_large":false,"large":false,"1536x1536":false,"2048x2048":false},"uagb_author_info":{"display_name":"Tobias Pries","author_link":"https:\/\/netguide.io\/linux\/author\/tobias-pries\/"},"uagb_comment_info":0,"uagb_excerpt":"SSH-Server absichern: Key-Login erzwingen, Root-Login und Passw\u00f6rter deaktivieren, den Port \u00e4ndern und mit Fail2ban Brute-Force-Angriffe automatisch blocken.","brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/4921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/comments?post=4921"}],"version-history":[{"count":2,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/4921\/revisions"}],"predecessor-version":[{"id":4967,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/posts\/4921\/revisions\/4967"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/media?parent=4921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/categories?post=4921"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/linux\/wp-json\/wp\/v2\/tags?post=4921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}