sudo apt update

sudo apt install ssh

sudo ufw allow 22      # if you have ufw running, but it doesn't hurt to run.

That's the very minimum. It allows unlimited failed password attempts on a known port. Direct root-login is disabled (you can still su and sudo once logged in). If your username and password are guessable and the Internet can see the server, somebody will eventually break in.

I can't stress this enough: You need to harden the default setup. You essentially trade convenience for the likelihood of being hacked but I've gone through several suggestions on my blog. At the very least, I'd suggest:

• Key-based logins. Disable password logins.


• Move it off port 22. Use something crazy-high, in the 20000-60000 range.


• Use fail2ban to ban people who do find it and try to brute it.

It'll take you less than 10 minutes and they take youfrom a 1/10000 chance of being broken in-to a probability so small, there isn't enough paper in the world to write its fraction. All assuming you're careful with your key, it has a passphrase of its own and you don't trumpet your credentials all over the net.

In terms of accessing this SSH server from the Internet, you may be facing local networking obstacles. If the computer is behind a NAT router (eg most home networks) without direct incoming access from the internet, you may need to look at port forwarding. Obviously if you don't need access outside the network, skipping this step will aide network security.