Hardening SSH: a practical checklist against brute force and unauthorized access

SSH is the front door of your servers, and its default configuration is a magnet for brute force: the moment you open port 22 to the Internet, automated login attempts start pouring in. The good news is that hardening it is quick and almost all of it fits in one file: /etc/ssh/sshd_config.

1. Keys, not passwords

A password can be brute-forced; a 256-bit key can't. Generate a modern pair and copy the public one to the server:

ssh-keygen -t ed25519 -C "your-name@machine"
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server

Confirm you can log in with the key, then disable passwords in sshd_config:

PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes

2. No direct root

Logging in as root over SSH removes the trail of who did what, and it's the most-attacked account. Log in as your user and escalate with sudo:

PermitRootLogin no

3. Restrict who can log in

By default any system user may try to authenticate. Limit it to the ones you need:

AllowUsers sergio deploy
# or by group:
AllowGroups ssh-users

4. Slow down brute force

Changing port 22 only reduces noise, it doesn't protect (that's security by obscurity). What actually helps:

• Firewall: expose SSH only to the IPs that need it, or put it behind a VPN or bastion.
• fail2ban: bans IPs after repeated failures. It's the standard and installs in two commands.
• Give the attacker less room in sshd_config:

MaxAuthTries 3
LoginGraceTime 20
MaxSessions 3

5. Modern ciphers

Disable old algorithms and keep only the strong ones. If you don't need them, turn off forwardings too:

KexAlgorithms curve25519-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com
X11Forwarding no
AllowAgentForwarding no

6. Two-factor

For sensitive access, add 2FA with libpam-google-authenticator (a TOTP code on top of the key) or move to SSH certificates signed by an internal CA, which expire and avoid handing out loose keys.

7. Watch it

Hardening isn't "set and forget". Review attempts in /var/log/auth.log (or journalctl -u ssh), and if you have a SIEM, alert on bursts of Failed password or off-hours logins from new IPs.

Checklist

• ✅ ed25519 keys, PasswordAuthentication no
• ✅ PermitRootLogin no
• ✅ AllowUsers/AllowGroups
• ✅ Firewall / VPN / bastion + fail2ban
• ✅ MaxAuthTries, LoginGraceTime tuned
• ✅ Modern ciphers, forwardings off
• ✅ 2FA or certificates for critical access
• ✅ Logs and alerts

Ten minutes of sshd_config turn a server that receives thousands of attempts a day into one where brute force simply has no way in.

Sergio Belmonte Morales
Cybersecurity Analyst · SOC · Sentinel/KQL specialist