SSH hardening checklist - locking down a new server

SSH hardening checklist - locking down a new server - Printable Version

+- TalkativeTurtles (https://talkativeturtles.club)
+-- Forum: Technology (https://talkativeturtles.club/forumdisplay.php?fid=2)
+--- Forum: Networking & Cybersecurity (https://talkativeturtles.club/forumdisplay.php?fid=12)
+--- Thread: SSH hardening checklist - locking down a new server (/showthread.php?tid=100)

SSH hardening checklist - locking down a new server - Zero Two - 06-22-2026

Every new VPS I spin up goes through this checklist before anything else is deployed. SSH is the most exposed attack surface on a Linux server.

Change the default SSH port (optional but reduces noise)

Code:
# /etc/ssh/sshd_config

Port 2222  # or any non-standard port

This doesn't improve security against targeted attacks but cuts automated scan noise by 90%.

Disable root login

Code:
PermitRootLogin no

Always. SSH in as a regular user and sudo when needed.

Disable password authentication (keys only)

Code:
PasswordAuthentication no

PubkeyAuthentication yes

Do this AFTER you've confirmed key-based login works. Locking yourself out is annoying.

Limit the login grace period

Code:
LoginGraceTime 20

MaxAuthTries 3

Specify allowed users

Code:
AllowUsers yourusername

Only accounts listed here can SSH in.

Disable unused features

Code:
X11Forwarding no

AllowAgentForwarding no

AllowTcpForwarding no  # unless you need tunnels

PermitTunnel no

Use a modern key algorithm
Generate keys with ssh-keygen -t ed25519. If you have old RSA keys on the server, keep them but prefer ed25519 for new ones.

Install fail2ban

Code:
sudo apt install fail2ban

# Default config jails SSH after 5 failed attempts

sudo systemctl enable --now fail2ban

After all changes:

Code:
sudo sshd -t          # test config syntax before reloading

sudo systemctl reload sshd

Keep your current session open and test login in a new terminal before closing anything. Never reload SSH blind.