Secure SSH Server Hardening on Linux
- AuthorKacey H.
- Date
- Time13 minutes
Step 1: Create a Non-Root Admin User
bash
sudo adduser deploy
sudo usermod -aG sudo deployStep 2: Generate SSH Key Pair on Local Machine
bash
ssh-keygen -t ed25519 -a 100 -C "deploy@myserver"Step 3: Copy Public Key to Server
bash
ssh-copy-id deploy@SERVER_IPStep 4: Harden sshd_config
bash
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak
sudo tee /etc/ssh/sshd_config >/dev/null <<'EOF'
Port 22
Protocol 2
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
PubkeyAuthentication yes
PermitEmptyPasswords no
X11Forwarding no
AllowAgentForwarding no
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy
EOFStep 5: Validate and Reload SSH
bash
sudo sshd -t
sudo systemctl reload ssh
sudo systemctl status ssh --no-pagerStep 6: Keep Current Session Open
Open a second terminal and verify key login works before closing your current root session.
bash
ssh deploy@SERVER_IPStep 7: Add Firewall Rule
bash
sudo ufw allow 22/tcp
sudo ufw limit 22/tcp
sudo ufw statusStep 8: Enable Fail2ban for SSH
bash
sudo apt install -y fail2ban
sudo tee /etc/fail2ban/jail.d/sshd.local >/dev/null <<'EOF'
[sshd]
enabled = true
maxretry = 4
findtime = 10m
bantime = 1h
EOF
sudo systemctl restart fail2ban
sudo fail2ban-client status sshdStep 9: Audit Authentication Logs
bash
sudo journalctl -u ssh -n 100 --no-pager
sudo tail -n 100 /var/log/auth.log"SSH hardening is a layered process: identity, transport, access control, and continuous auditing."
