Lesson 3.8: Hardening SSH
SSH is the front door of almost every Linux server, and bots try it all day. How to read the authentication log, which settings matter most (no root login, no passwords, few attempts, nothing that isn't needed), how to make sure you won't lock yourself out, and how to apply changes safely with sshd -t and a reload. In the lab you count failed root logins from the internet, confirm your key works, switch off root and password logins, check the configuration, reload, and read the effective settings with sshd -T.
17 min
You will learn to
- Read SSH authentication logs
- Name the most important sshd settings
- Avoid locking yourself out
- Validate with sshd -t and reload safely
- Read effective settings with sshd -T
Key terms
- PermitRootLogin
- Whether root may log in over SSH. no: admins log in as themselves and use sudo.
- PasswordAuthentication
- Whether passwords are accepted. no: only keys (or certificates), immune to password guessing.
- MaxAuthTries
- How many authentication attempts one connection may make.
- sshd -t and sshd -T
- -t tests the configuration; -T prints the effective settings after all files are merged.
- fail2ban
- A tool that watches logs and temporarily blocks addresses with too many failures.
← IPv6: the next generation of addresses · All lessons · Broken access control and IDOR →