SSH hardening: keys, ciphers, and config for a locked-down server

Harden SSH on a Linux server: disable password login, restrict ciphers, limit users, and use Ed25519 keys.

Server SecurityIntermediate

Why

SSH is the most brute-forced service on the internet. Default config allows password login, root login, and old ciphers — a single weak password or leaked key gives full shell access.

Hardening cuts attack surface to near zero.

When

Apply on every new Linux server before exposing port 22, and re-audit annually or after any breach scare. Avoid security theater (obscurity without depth) — a non-standard SSH port stops 0 real attacks.

Skip heavy WAF rules if you have no known vulnerabilities; they add latency and false positives.

How

1. Generate an Ed25519 key: `ssh-keygen -t ed25519 -a 100 -f ~/.ssh/server_ed25519`. 2. Copy to server: `ssh-copy-id -i ~/.ssh/server_ed25519.pub user@host`. 3. Test key login works before editing config. 4. Edit /etc/ssh/sshd_config: set PermitRootLogin no, PasswordAuthentication no, PubkeyAuthentication yes, KbdInteractiveAuthentication no, PermitEmptyPasswords no, MaxAuthTries 3, LoginGraceTime 15, AllowUsers deploy, X11Forwarding no. 5. Set modern ciphers/MACs/KexAlgorithms (drop 3des, sha1). 6. Restart sshd: `systemctl restart sshd`. 7. Keep one root session open in another terminal until you confirm the new config lets you in.

Example

// security-ssh-hardening — configuration example const config = { provider: "security" }; # /etc/ssh/sshd_config (hardened excerpt) PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes KbdInteractiveAuthentication no PermitEmptyPasswords no MaxAuthTries 3 LoginGraceTime 15 AllowUsers deploy X11Forwarding no ClientAliveInterval 300 ClientAliveCountMax 0 Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com MACs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org # Test config syntax before restart sshd -t && systemctl restart sshd

Common Problems

⚠Locking yourself out by disabling password auth before confirming key login works — keep a root session open.
⚠sshd -t passes but a typo in AllowUsers blocks everyone — test from a second terminal before closing.
⚠Old clients (RHEL 6, old Putty) can't connect after dropping legacy ciphers — upgrade clients or keep one fallback.

Best Practices

✓Use Ed25519 keys (shorter, faster, quantum-resistant-ish) over RSA; if RSA, require 4096-bit.
✓Add a passphrase to keys and use ssh-agent so a stolen key file alone can't log in.
✓Move SSH off port 22 to a high port (e.g. 22022) to cut log noise from automated scanners — defense in depth, not real security.

FAQ

What is SSH hardening: keys, ciphers, and config for a locked-down server and what problem does it solve?

Harden SSH on a Linux server: disable password login, restrict ciphers, limit users, and use Ed25519 keys. It lets developers deploy, store, and scale without self-managing infrastructure — a core reference for cloud service selection.

How do I get started with SSH hardening: keys, ciphers, and config for a locked-down server in 5 minutes?

Two steps to run it: (1) Generate an Ed25519 key: `ssh-keygen -t ed25519 -a 100 -f ~/.ssh/server_ed25519`.; (2) Copy to server: `ssh-copy-id -i ~/.ssh/server_ed25519.pub user@host`.. Validate on the free tier first, then wire into production.

What is the #1 pitfall with SSH hardening: keys, ciphers, and config for a locked-down server?

The most frequent issue is: Locking yourself out by disabling password auth before confirming key login works — keep a root session open.. Run a pre-launch checklist item by item, and add policy/config scanning in CI.

What are the best practices for SSH hardening: keys, ciphers, and config for a locked-down server?

Best practices for SSH hardening: keys, ciphers, and config for a locked-down server include: Use Ed25519 keys (shorter, faster, quantum-resistant-ish) over RSA; if RSA, require 4096-bit.; Add a passphrase to keys and use ssh-agent so a stolen key file alone can't log in.; Move SSH off port 22 to a high port (e.g. 22022) to cut log noise from automated scanners — defense in depth, not real security.. The first one — "Use Ed25519 keys (shorter, faster, quantum-resistant-ish) over RSA; if RSA, require 4096-bit." — should be a team default baked into your IaC templates.

How do I control cost and avoid bill surprises with SSH hardening: keys, ciphers, and config for a locked-down server?

Three ways to prevent overspend: (1) tag every resource with env/team and enable billing alarms; (2) set budget thresholds to trigger Slack/email alerts; (3) review idle resources in Cost Explorer regularly and clean them up. Most SSH hardening: keys, ciphers, and config for a locked-down server options offer a free tier — validate within free quota before scaling.