Locking down SSH

SSH is the front door of your server, and bots try it within minutes of a server going online.

Recommended settings

In /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
AllowUsers deploy

Check the syntax with sudo sshd -t, then sudo systemctl reload ssh. Keep your current session open until a new login works.

Use strong keys

Create Ed25519 keys and protect them with a passphrase:

ssh-keygen -t ed25519 -C "you@yourcompany.com"

Remove keys of people who've left from ~/.ssh/authorized_keys on every server.

Block brute force

sudo apt install fail2ban

Its default SSH jail bans an IP after repeated failures. Check it with sudo fail2ban-client status sshd.

Go further

• Require two-factor authentication for SSH with a TOTP module.
• Put SSH behind a VPN or bastion host, so it isn't public at all.