SSH security guides
Practical write-ups on how password-guessing attacks against Linux servers actually work, how to read what your own auth log is telling you, and which defences are worth the effort.
All guides
What an SSH brute-force attack actually looks like
Anatomy of the traffic that reaches every Linux server with port 22 open: who runs it, what it is really trying, and which defences change the volume rather than absorbing it.
Reading the SSH auth log: what every failure line means
Where failed SSH logins are recorded on each distribution, how to decode the message variants, and how to tell a mistyped password from a botnet working a list.
Where fail2ban stops being enough
fail2ban is a good tool and the right first answer. Here is precisely where it runs out, how to push it further yourself, and what it cannot do at any configuration.
Turning off SSH password authentication without locking yourself out
Keys-only is the strongest single change you can make to an exposed SSH server. The safe order to do it in, the config lines that actually matter, and what it does not fix.
Changing the SSH port from 22: what it fixes and what it doesn't
Moving SSH off port 22 cuts attack volume dramatically and protects you from almost nothing. How to do it without locking yourself out, including the two steps most guides omit.
SSH hardening checklist for internet-facing Linux servers
An ordered checklist for a Linux server that has to accept SSH from the internet — what to do first, what most lists get wrong, and what you can safely leave until later.
See it against your own attack stream
One server, free forever, no card. The agent installs in a minute and whitelists your current address before it blocks anything.