Hardening SSH

October 20, 2026 · admin

1. Use keys and create a sudo user

adduser deploy
usermod -aG sudo deploy
rsync --archive --chown=deploy:deploy ~/.ssh /home/deploy

Check you can log in as deploy with your key before continuing.

2. Tighten sshd_config

Create /etc/ssh/sshd_config.d/hardening.conf:

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3

sudo sshd -t && sudo systemctl restart ssh

3. Firewall

sudo ufw allow OpenSSH
sudo ufw enable

4. Block brute-force attempts

sudo apt install -y fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

5. Keep the system updated

sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Locked yourself out? Use the VNC console to undo the change.

Back to the blog