How to harden an SSH server: the sshd_config settings that matter

The settings with the biggest impact

PasswordAuthentication no and KbdInteractiveAuthentication no turn off password logins, which removes guessing. PermitRootLogin no forces administrators to log in as themselves and use sudo, which leaves an audit trail. AllowGroups ssh-users or AllowUsers restricts which accounts may log in at all.

MaxAuthTries 3 and LoginGraceTime 30 reduce how long an unauthenticated connection can hang around. X11Forwarding no and AllowTcpForwarding no, unless needed, close features attackers use to pivot.

Snippet

# /etc/ssh/sshd_config.d/10-hardening.conf
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowGroups ssh-users
MaxAuthTries 3
LoginGraceTime 30
X11Forwarding no
AllowTcpForwarding no

Algorithms

Recent OpenSSH releases already disable weak algorithms. On older systems, restrict key exchange to curve25519-sha256 and the sntrup761x25519 hybrid where available, host keys to ssh-ed25519 and rsa-sha2-512, and ciphers to chacha20-poly1305 and AES-GCM. Remove DSA host keys entirely.

Check what the server actually offers with ssh -Q for local support and Nmap’s ssh2-enum-algos from another host.

Lab: change safely

Make sure your key login works and your account is in ssh-users before disabling passwords. Write the drop-in file, validate with sshd -t, and reload. Keep your current session open while you test a new one. If the new session fails, fix the config from the open session.

Then confirm the effective configuration with sshd -T, which prints the merged settings, and try a password login from another machine to confirm it is refused.

Snippet

sudo groupadd -f ssh-users && sudo usermod -aG ssh-users $USER
sudo sshd -t && sudo systemctl reload ssh
sudo sshd -T | grep -Ei "permitrootlogin|passwordauthentication|allowgroups|maxauthtries"
ssh -o PreferredAuthentications=password -o PubkeyAuthentication=no user@192.168.56.101

Beyond the config file

Restrict SSH to a management network or VPN with the firewall. Consider SSH certificates or hardware-backed keys for larger teams. Log and alert on logins from new source addresses.

Drop-in files under sshd_config.d are read in order, and the first value for most options wins. Check that a distribution file is not setting PasswordAuthentication yes earlier than yours.

Diagram

Default-ish SSH versus hardened SSH

What an internet scanner can try.

Before

Logins. Passwords allowed, root allowed.

Accounts. Any local user.

Risk. Password guessing and shared root use.

After

Logins. Keys only, no root.

Accounts. ssh-users group only.

Risk. Stolen key is the main path; protect keys.

Check yourself

1. Which setting removes SSH password guessing?

2. What should you run before reloading sshd after edits?

3. Your drop-in sets PasswordAuthentication no but sshd -T says yes. Why?