Thousands of automated attacks are carried out daily against every server on the internet, aimed at gaining access. User authentication based solely on username and password proves vulnerable to attacks such as brute-force attacks, phishing, key loggers, etc.
With years of experience in managed hosting and server management, security is an integral part of responsible server administration. In this context, we implement two-factor authentication (2FA) with hardware tokens for access to our servers.
Hardware tokens are physical authentication devices that generate unique access codes. They are small devices (like keychains) that operate independently of mobile phones or network connections, offering reliable security.
2FA hardware tokens provide the most reliable protection against modern authentication attacks. Unlike other 2FA methods, such as mobile apps or SMS, physical hardware tokens provide the maximum level of protection that cannot be bypassed by modern interception techniques.
During the initial setup of a dedicated server in our infrastructure, we ensure to provide you with hardware tokens that are activated only for your server. In case you or your associates already have hardware tokens from our company, we can, after your authorization, activate them for access to your new server as well.
Key Threats – Why Password Isn’t Enough
Despite awareness of cybersecurity issues, many system administrators continue to rely exclusively on passwords to protect their dedicated servers, even for administrator access! This approach constitutes a serious security gap in today’s hosting systems, which face breach attempts at multiple levels 24/7. Below we present the key threats of exclusive password usage.
Brute-force and Dictionary Attacks
Brute-force attacks are a daily reality for every exposed server. Attackers use specialized applications to try character combinations until they discover the correct password.
Even more effective are dictionary attacks, as they use predetermined lists of common passwords and their variations. Attackers have specialized tools that try tens of thousands of combinations per second. A seemingly strong 8-character password can be breached in less than one day with modern processors.
Of course, every modern server takes not one but multiple security measures so that such attacks are repelled timely and efficiently.
Phishing, Social Engineering, and the Human Factor
![]()
Phishing and social engineering target the weakest link in security – the human factor.
Attackers contact users with carefully designed messages or phone calls and imitate legitimate services, urging recipients to reveal their credentials (phishing) or use psychological techniques to deceive users (social engineering). Attackers, for example, impersonate automated systems, support technicians, colleagues, or managers to gain access to credentials (e.g., username/password) and sensitive systems.
Also significant is human error in password management, mainly due to convenience, lack of organizational measures, or awareness. The phenomenon of storing passwords in Excel, Word, or simple text files has not been completely eliminated. These methods constitute a serious risk, as a malicious user or intruder can easily obtain and exploit them. Such practices significantly weaken security and can lead to data breaches.
Keyloggers and Password Interception
Keyloggers are malicious applications that record every keystroke on the victim’s computer, including passwords. They are installed through malicious links, infected attachments, or physical access to the device.
A keylogger operates silently for months, recording all data the victim types, from SFTP/SSH credentials to email management credentials. The most complex passwords offer no protection, as they are recorded at the moment of typing.
SSH/SFTP Attacks
SSH is the de facto secure protocol for remote management of dedicated Linux/Unix servers. Despite the strong encryption it offers, it remains vulnerable when protected only by password.
Automated tools continuously scan the internet for open SSH ports, trying combinations of usernames and passwords.
Once an intruder gains SSH access, they can install malware, create backdoors for future access, execute attacks against other servers, and intercept sensitive data.
Therefore, it becomes clear that the exclusive use of username and password for such a “sensitive” service as SSH is insufficient, regardless of password complexity. Stronger security solutions are needed that offer multiple levels of protection. After all, the cost of a data breach is many times the cost of implementing advanced security measures.
What 2FA Offers
Two-factor authentication upgrades security from the level of “something you know,” i.e., the password, to a dual protection system by incorporating the element of “something you own,” i.e., the physical device – hardware token. In practice, this means that even if your password is leaked, the intruder cannot gain access without possession of the physical token.
It’s worth noting that using two different pieces of information based exclusively on knowledge does not constitute two-factor authentication. The existence of a physical element is a prerequisite.
Protection of Server Logins
An important security measure we implement on all our dedicated servers is the enforcement of 2FA for SSH/SFTP connections. This action offers practical benefits such as:
- Neutralization of brute-force attacks: Automated attacks cannot bypass the need for an extra code from the physical token
- Protection from phishing: The additional authentication factor generates unique one-time codes that cannot be copied or changed
- Neutralization of keyloggers: Even if the password is recorded, it remains useless without the extra code from the token provided by a separate device
- Accurate access logging: You know with certainty who and when connects, as there is extensive logging
Systems with 2FA have almost zero incidents of unauthorized access. In contrast, systems that rely exclusively on username and password usage remain particularly vulnerable regardless of how complex the chosen password is.
Additionally, 2FA creates detailed logs for every connection attempt, providing complete traceability. This traceability is crucial for compliance with the GDPR standard, ensuring that the business has the necessary evidence for secure access management.
The Case of Shared Access
In environments where multiple users (e.g., developers) need access to the same account and share the password (which is not recommended), 2FA offers unique control capabilities.
Each team member sharing access has their own physical token, ensuring personal responsibility and identification. Access management is done per token, regardless of password.
The use of hardware tokens also allows immediate removal of access when required. For example, if an employee leaves or an external collaborator completes their project, simply deactivating the corresponding token is enough to terminate access, until password change is organized and communicated with the rest of the team members.
Therefore, the use of 2FA is an important ally for access security in modern business environments.
Superiority Over Pubkey
The use of two-factor authentication (2FA) for SSH access is superior to classic public/private key authentication (pubkey authentication), as the latter, even when protected by password, remains a digital file that can be intercepted and copied. In essence, both the key and the passphrase fall into the “something you know” category.
In contrast, using a hardware token introduces the “something you own” factor, which is impossible to reproduce digitally. Thus, while a stolen private key can be used repeatedly by the intruder, hardware 2FA requires the physical presence of the device that generates unique, dynamic codes.
2FA Hardware Tokens: Why They’re Superior
Hardware tokens are superior to other alternative 2FA methods (such as mobile apps, email, SMS), as they offer guarantees such as the following:
- Superior security: Tokens cannot be copied or affected by malware, unlike mobile applications that depend on phone security.
- Complete autonomy: They operate without network connection or mobile signal, ensuring uninterrupted access to systems.
- Physical durability: Specially manufactured tokens withstand physical wear, moisture, and extreme usage conditions.
- Dedicated purpose: They serve only for security, reducing the attack surface compared to multifunctional devices.
How Tokens Help with GDPR Compliance
In GDPR compliance environments, hardware tokens enable indisputable identification of the user accessing personal data.
Given that GDPR requires every entity handling personal data to implement appropriate technical and organizational protection measures, the adoption of hardware 2FA in the hosting sector is not just an advanced security practice, but a substantial compliance safeguard.
Particular value for compliance is offered by the detailed traceability capability, as each connection is accompanied by independent logging of physical device usage.
Safer Hosting in Practice
The security of servers hosting websites is a daily reality that requires substantial solutions, not just theoretical approaches. In practice, security measures that include only passwords are exposed to constantly evolving attacks.
2FA hardware tokens offer real protection extensively tested on our servers. These devices are superior to mobile apps and SMS, while simultaneously ensuring full compliance with GDPR requirements through precise access logging. The adoption of hardware tokens, we’ve seen in practice, drastically reduces breach incidents, even in complex environments with multiple administrators.
TL;DR
2FA hardware tokens offer the most reliable login protection against modern cyber threats:
- Traditional passwords are vulnerable to brute force, phishing, keyloggers, and SSH attacks that target servers daily
- Hardware tokens provide superior security over mobile apps and SMS, as they are impossible to copy or be affected by malicious software
- The use of hardware tokens ensures full GDPR compliance through precise access logging and indisputable identification
- In cases of password sharing, tokens allow immediate access control and personal responsibility for each user
The adoption of 2FA hardware tokens to protect your server and websites is a necessity for every business handling personal data. The investment in this technology is minimal compared to the cost of a potential breach.
