Practical SSH Hardening

SSH is the front door to most servers, which makes it the first thing worth hardening. You don’t need an elaborate setup — a few changes remove the vast majority of automated attacks.

Use keys, not passwords

Password authentication invites brute-force attempts. Generate a key pair and disable password logins once you’ve confirmed the key works.

ssh-keygen -t ed25519 -C "you@example.com"
ssh-copy-id you@server

Tighten the daemon config

Edit /etc/ssh/sshd_config with a few opinionated defaults:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no

Then reload the service:

sudo systemctl reload ssh

Don’t forget the basics

• Keep the host patched.
• Restrict access with a firewall where you can.
• Watch the logs — journalctl -u ssh tells you who is knocking.

None of this is exotic. The point of hardening is to be boring on purpose: fewer ways in means fewer things to worry about.