SSH Security

This guide shows how to harden SSH on a Linux server.

Apply the changes step by step and do not close your current SSH session until you verify the new configuration.

Before you start

Make sure you have:

• access to the server as root or through a user with sudo;
• OpenSSH in use;
• a way to restore access from the provider console if you lock yourself out.

If the server uses ssh.socket instead of the regular ssh.service, disable socket mode first:

sudo systemctl stop ssh.socket
sudo systemctl disable ssh.socket

sudo systemctl enable ssh
sudo systemctl restart ssh

You can check the current mode with:

sudo systemctl status ssh

Step 1. Restrict SSH access

The main settings are stored in /etc/ssh/sshd_config.

Disable root login

First create a separate administrative user:

useradd -m -U -s /bin/bash -G sudo holu
passwd holu

Then disable root login:

PermitRootLogin no

Limit idle time

To disconnect an SSH session after inactivity, add:

ClientAliveInterval 300
ClientAliveCountMax 1

Allow only specific users

If only certain accounts should be allowed to connect, list them explicitly:

AllowUsers holu holu2

Change the default port

Change the port from 22 to any other port you want to use for SSH:

Port SELECTED_PORT

If you change the port, remember to update your firewall rules.

Disable unused features

Disable features that are not needed for regular SSH access:

AllowTcpForwarding no
X11Forwarding no
AllowAgentForwarding no
AuthorizedKeysFile .ssh/authorized_keys

Step 2. Limit login failures

To reduce brute-force risk, limit the number of login attempts:

MaxAuthTries 2

Step 3. Enable key-based login

Make sure public-key authentication is enabled:

PubkeyAuthentication yes

Create a key on the client

On the client machine, generate a key:

ssh-keygen -t rsa -b 4096

Add the public key to the server

On a Linux client, copy the key with:

ssh-copy-id -i ~/.ssh/id_rsa.pub -p SELECTED_PORT holu@your_host

On Windows, you can manually add the public key contents to:

/home/holu/.ssh/authorized_keys

Test the key-based connection:

ssh -i ~/.ssh/id_rsa -p SELECTED_PORT holu@your_host

Step 4. Enable two-factor authentication

If you want an additional layer of protection, use Google Authenticator or Aegis.

Install the package

On Ubuntu / Debian:

apt install libpam-google-authenticator

On CentOS / RedHat:

yum install epel-release
yum install google-authenticator

On Arch Linux:

pacman -S libpam-google-authenticator

On openSUSE / SLES:

zypper install google-authenticator-libpam

Configure Google Authenticator

Start the setup:

google-authenticator

Then:

1. Answer y if you want time-based tokens.
2. Scan the QR code in the app.
3. Save the backup codes.
4. Confirm the remaining prompts.

Connect PAM to SSH

In /etc/pam.d/sshd, comment out:

@include common-auth

Then add:

auth required pam_google_authenticator.so

In /etc/ssh/sshd_config, enable:

ChallengeResponseAuthentication yes
UsePAM yes
AuthenticationMethods publickey,keyboard-interactive

If you are using Ubuntu 22.04 or newer, use this instead of ChallengeResponseAuthentication:

KbdInteractiveAuthentication yes

Restart SSH:

systemctl restart ssh

Step 5. Verify the configuration

Before restarting SSH, check the syntax:

sshd -t

If there are no errors, apply the settings:

systemctl restart ssh

Verification

After all changes:

• open a new SSH connection;
• check key-based login;
• check 2FA login if you enabled it;
• make sure the old access methods are no longer needed.

If everything is configured correctly, SSH will be much more secure.