SSH Hardening

Key-based authentication, sshd_config hardening, jump hosts, port forwarding, and certificate-based auth.

Overview

SSH is the primary remote access mechanism for Linux servers. Default configurations are permissive; production servers require explicit hardening.

Authentication Hardening

  • Disable password authentication: PasswordAuthentication no
  • Disable root login: PermitRootLogin no
  • Restrict to specific users/groups: AllowUsers, AllowGroups
  • Use ed25519 keys — faster and stronger than RSA 2048

Network Hardening

  • Change the default port (Port 2222) to reduce automated scan noise
  • Set MaxAuthTries 3 and LoginGraceTime 30
  • Disable AllowTcpForwarding no and X11Forwarding no unless needed

Brute-Force Protection

fail2ban automatically bans IPs with repeated failed authentication attempts.

SSH Agent Forwarding Risk

ForwardAgent yes is a security risk — a compromised jump host can use your local agent. Use ProxyJump instead:

Key concepts

PasswordAuthentication no
Disables password login for SSH. Essential for any internet-facing server — set in /etc/ssh/sshd_config.
ed25519 keys
Modern elliptic curve algorithm. Stronger than RSA 2048, faster to generate and sign. Generate with ssh-keygen -t ed25519.
ProxyJump
SSH through a jump host without agent forwarding: ssh -J user@jumphost user@target. The jump host never sees your private key.
SSH CA
A keypair that signs user SSH certificates. Servers trust the CA public key. Enables expiry and revocation without per-server authorized_keys.
fail2ban
Bans IPs with repeated failed authentication attempts by writing iptables rules.

When to use it

  • Hardening a new EC2 instance before making it production-facing
  • Setting up a bastion/jump host pattern for VPC access without a VPN
  • Replacing ad-hoc key distribution with a CA-based SSH trust model

Interview questions

  • How do you set up a secure bastion host pattern for accessing private EC2 instances?
  • Explain how certificate-based SSH works and why it is better than authorized_keys management.

Sign up free to read the full topic

More Linux topics

Start free on Cariara · Coding problems · System design studio