Hardening SSH on a Linux Server

SSH is the main door into most Linux servers, so it is a common target for attackers. Hardening it reduces the chance that a leaked password or a brute-force attempt gives access.

Start by generating a key pair on your own computer and copying the public key to the server:

bash ssh-keygen -t ed25519 -C "laptop-2026" ssh-copy-id -i ~/.ssh/ided25519.pub [email protected] ssh [email protected]

Once key login works, edit the server configuration in /etc/ssh/sshdconfig:

- PasswordAuthentication no stops password logins entirely. - PermitRootLogin no forces administrators to log in as a named user and use sudo. - MaxAuthTries 3 limits guesses per connection. - AllowUsers deploy restricts logins to listed accounts.

Always test the configuration before reloading, and keep your current session open while you do:

bash sudo sshd -t sudo systemctl reload ssh

On Debian and Ubuntu the service is named ssh, while on RHEL-based systems it is usually sshd. Open a second terminal and confirm you can still log in before closing the first one.

Add a firewall rule so only needed ports are open, for example sudo ufw allow OpenSSH, and consider fail2ban to block repeated failed attempts. Check the audit trail with sudo journalctl -u ssh --since today.