SSH Hardening Best Practices

# Ed25519 (recommended)
ssh-keygen -t ed25519 -C "your@email.com"

# RSA (wider compatibility)
ssh-keygen -t rsa -b 4096 -C "your@email.com"

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

# Or manually
cat ~/.ssh/id_ed25519.pub | ssh user@server 'mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys'

chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

# Disable password authentication
PasswordAuthentication no
ChallengeResponseAuthentication no

# Disable root login
PermitRootLogin no

# Limit users
AllowUsers deploy admin
# Or by group
AllowGroups ssh-users

# Change default port (reduces noise)
Port 2222

# Protocol 2 only (v1 is insecure)
Protocol 2

# Disable empty passwords
PermitEmptyPasswords no

# Set login grace time
LoginGraceTime 30

# Max auth attempts
MaxAuthTries 3

# Max sessions
MaxSessions 3

# Disable X11 forwarding (if not needed)
X11Forwarding no

# Disable TCP forwarding (if not needed)
AllowTcpForwarding no

# Disable agent forwarding (if not needed)
AllowAgentForwarding no

# Log level
LogLevel VERBOSE

# Idle timeout (5 minutes)
ClientAliveInterval 300
ClientAliveCountMax 0

# Test config syntax
sudo sshd -t

# Reload (don't restart — keep current session!)
sudo systemctl reload sshd

sudo apt install fail2ban

# /etc/fail2ban/jail.local
[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600       # 1 hour
findtime = 600       # 10 minute window

sudo systemctl enable --now fail2ban

# Check status
sudo fail2ban-client status sshd

# Unban an IP
sudo fail2ban-client set sshd unbanip 203.0.113.50

Host production
    HostName 10.0.1.50
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
    ServerAliveInterval 60

Host staging
    HostName 10.0.2.50
    User deploy
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

# Jump through bastion
Host internal-*
    ProxyJump bastion

Host bastion
    HostName bastion.example.com
    User admin
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Host internal-db
    HostName 10.0.3.100
    User dbadmin

Host internal-app
    HostName 10.0.3.101
    User deploy

ssh production          # Instead of: ssh -p 2222 -i ~/.ssh/id_ed25519 deploy@10.0.1.50
ssh internal-db         # Automatically jumps through bastion

Internet → Bastion (public IP) → Internal servers (private IPs)

# Direct jump
ssh -J bastion.example.com internal-server

# Multi-hop
ssh -J bastion1,bastion2 internal-server

# On bastion server sshd_config
AllowTcpForwarding yes      # Required for proxying
AllowAgentForwarding no
X11Forwarding no
PermitRootLogin no
MaxSessions 10

sudo apt install libpam-google-authenticator

# Run as the user
google-authenticator

# /etc/pam.d/sshd
auth required pam_google_authenticator.so

# /etc/ssh/sshd_config
AuthenticationMethods publickey,keyboard-interactive
ChallengeResponseAuthentication yes

# Recent logins
last -n 20

# Failed login attempts
grep "Failed password" /var/log/auth.log | tail -20

# Currently connected
who
w

# Active SSH sessions
ss -tnp | grep ssh

# Check for password auth
grep "PasswordAuthentication" /etc/ssh/sshd_config

# Check for root login
grep "PermitRootLogin" /etc/ssh/sshd_config

# Check authorized_keys for unknown keys
cat ~/.ssh/authorized_keys

# Check for weak host keys
ssh-keygen -lf /etc/ssh/ssh_host_*_key.pub

# Check listening port
ss -tlnp | grep sshd