FlashPanel

SSH ​

No need to open a terminal or edit files manually. You can change SSH server settings with just a few clicks.

What Does This Feature Do? ​

This feature lets you update the SSH security settings of your VPS (in sshd_config) directly through the web, without SSH access or editing files manually.

Instead of editing /etc/ssh/sshd_config by hand, you can:

  • Enable/disable password login
  • Restrict how the root account logs in over SSH
  • Choose which users are allowed to log in over SSH
  • Change the maximum number of failed login attempts
  • Configure the SSH port, listen addresses, timeouts, etc.
  • And many other security settings

Interface Overview ​

The top of the form has the following buttons:

  • Recommended: fills the form with the recommended security values
  • sshd_config: opens the server's current /etc/ssh/sshd_config file for viewing
  • Refresh: reloads the configuration currently applied on the server

Each option shows a short description and a warning when the selected value is less secure.

How to Use It ​

  1. In the server menu, open Security > SSH. The Update SSH Configuration form is displayed.

  2. Click the Recommended button to fill in the recommended security settings

    • The recommended values are only filled into the form; they are not applied to the server until you click Update
    • The SSH port (Port) and the allowed users list (AllowUsers) are left unchanged
    • You can still adjust individual settings after clicking this button

  3. Or customize the following options:

    • Port: SSH port number (default: 22). Ports 80, 443, and 2022 cannot be used. You can enter several ports so SSH listens on all of them at once (e.g. 22 and 2222); the panel keeps connecting through the port it currently uses and only switches to the first port in the list when you remove that port
    • ListenAddress: IP addresses the SSH server listens on
    • PermitRootLogin: Allow root to log in with a password or with an SSH key only
    • PasswordAuthentication: Enable/disable password login
    • UsePAM: Enable/disable PAM authentication
    • KbdInteractiveAuthentication: Enable/disable keyboard-interactive authentication (requires UsePAM)
    • AllowUsers: List of users allowed to connect via SSH
    • MaxAuthTries: Maximum number of authentication attempts
    • MaxSessions: Maximum number of sessions per connection
    • MaxStartups: Maximum number of unauthenticated connections
    • LoginGraceTime: Time limit for successful authentication
    • TCPKeepAlive: Enable/disable TCP keepalive messages
    • ClientAliveInterval: Time between keepalive messages
    • ClientAliveCountMax: Maximum missed keepalive messages before disconnection
    • AllowTcpForwarding: Enable/disable TCP port forwarding
    • GatewayPorts: Allow remote hosts to connect to forwarded ports
    • X11Forwarding: Enable/disable X11 forwarding
    • PermitTunnel: Enable/disable tunnel device forwarding
    • LogLevel: Logging verbosity level
    • PrintMotd: Display message of the day after login
    • PrintLastLog: Show last login information
    • PermitUserRC: Allow execution of ~/.ssh/rc at login

After Making Changes? ​

  1. Click the Update button
  2. The system will:
    • Validate your configuration
    • Automatically update the sshd config
    • Open only the newly added SSH ports in the firewall and remove the rules of the ports you removed. Existing rules of ports you keep (for example, a rule limited to your IP) stay unchanged
    • Update the ports of the sshd jail if Fail2Ban is installed, so every SSH port stays protected
    • Restart the SSH service if needed

What If Something Goes Wrong? ​

  • The system will not apply a configuration with syntax errors
  • It automatically restores the previous backup if SSH fails to restart
  • Errors will be displayed clearly

Tips & Safety Notes ​

⚠️ CautionDescription
Avoid editing /etc/ssh/sshd_config directly if you're using this interfacePrevents conflict or overwrite
Before disabling PasswordAuthentication, add an SSH key for every user who needs to log inOtherwise you can no longer log in over SSH with a password
When changing Port, also open the new port in your VPS provider's firewall (if any)Otherwise you may lose SSH access
If you lose SSH access after changing settingsUse the VPS provider's web console to revert safely

FAQ ​

  • ❓ Do I need to reboot the server?

    🔹 No. The SSH service is restarted automatically if needed.

  • ❓ Can I break SSH access by mistake?

    🔹 The system checks the syntax and automatically restores the previous configuration on failure. However, it cannot prevent valid settings that lock you out, such as disabling password login before adding an SSH key, or removing your user from AllowUsers. Review your changes carefully before clicking Update.

  • ❓ What does the Recommended button do?

    🔹 It fills in the recommended security settings, including:

    • Disabling password authentication (requires SSH keys)
    • Allowing root to log in with an SSH key only
    • Limiting failed login attempts and the authentication timeout
    • Setting sensible keepalive values
    • Disabling TCP, X11, and tunnel forwarding
    • Setting the log level to INFO

    Click Update to apply these values to the server.