A short SSH hardening checklist

2026-05-11

The basics, in the order I apply them on a new server:

1. Add your public key and confirm you can log in with it.
2. Set PasswordAuthentication no in a drop-in under /etc/ssh/sshd_config.d/.
3. Use PermitRootLogin prohibit-password or a separate user.
4. Install fail2ban with an incremental ban time.

Always keep a second session open while you restart sshd, and keep console access handy in case you lock yourself out.

← All posts