[{"data":1,"prerenderedAt":361},["ShallowReactive",2],{"guide-\u002Fguides\u002Flinux-ssh-hardening-checklist":3,"mdc-pre:IRSrVY822_BZO4S5qhZ9nOJhBKoR7Jri-aF-QiZJWtA":360},{"id":4,"title":5,"body":6,"date":344,"description":345,"draft":346,"extension":347,"featured":348,"keyTakeaway":349,"meta":350,"navigation":348,"path":351,"primaryKeyword":352,"seo":353,"service":354,"stem":355,"tags":356,"__hash__":359},"guides\u002Fguides\u002Flinux-ssh-hardening-checklist.md","SSH hardening on a Linux server — a practical checklist",{"type":7,"value":8,"toc":329},"minimark",[9,13,17,22,30,34,37,45,49,74,78,83,94,111,115,129,133,148,152,155,177,181,188,200,204,270,277,281,292,296,309,325],[10,11,5],"h1",{"id":12},"ssh-hardening-on-a-linux-server-a-practical-checklist",[14,15,16],"p",{},"For operators with one or a few internet-facing Linux hosts who want fewer opportunistic attacks without a full redesign of the estate.",[18,19,21],"h2",{"id":20},"key-takeaway","Key takeaway",[14,23,24,25,29],{},"Most real-world SSH abuse is opportunistic: password guessing and open root login. Disabling password auth, blocking direct root, restricting who can connect, and verifying with ",[26,27,28],"code",{},"sshd -T"," removes the easy wins — if you keep a recovery path open while you change config.",[18,31,33],{"id":32},"why-defaults-are-not-enough","Why defaults are not enough",[14,35,36],{},"OpenSSH is built for compatibility. On a public VPS that often means password auth still possible, root reachable over the network, and port 22 open to the world. Attackers do not need a clever exploit; they need a weak login path.",[14,38,39,40,44],{},"This guide is a practical checklist for a ",[41,42,43],"strong",{},"single Linux server",", not a CIS audit of a whole fleet.",[18,46,48],{"id":47},"before-you-change-anything","Before you change anything",[50,51,52,56,59,67],"ol",{},[53,54,55],"li",{},"Keep an existing SSH session open until a new login works.",[53,57,58],{},"Prefer console or provider recovery access (Hetzner, DigitalOcean, AWS, etc.) before you disable passwords.",[53,60,61,62,66],{},"Prefer a second admin user with a working key ",[63,64,65],"em",{},"before"," you turn off password auth.",[53,68,69,70,73],{},"Take a note of the current effective config: ",[26,71,72],{},"sudo sshd -T | less",".",[18,75,77],{"id":76},"checklist","Checklist",[79,80,82],"h3",{"id":81},"_1-prefer-key-authentication-disable-passwords","1. Prefer key authentication; disable passwords",[14,84,85,86,89,90,93],{},"In ",[26,87,88],{},"\u002Fetc\u002Fssh\u002Fsshd_config"," (or a drop-in under ",[26,91,92],{},"\u002Fetc\u002Fssh\u002Fsshd_config.d\u002F","):",[95,96,97,102,108],"ul",{},[53,98,99],{},[26,100,101],{},"PasswordAuthentication no",[53,103,104,107],{},[26,105,106],{},"KbdInteractiveAuthentication no"," (where supported)",[53,109,110],{},"Confirm your user can log in with a key first",[79,112,114],{"id":113},"_2-disable-direct-root-login","2. Disable direct root login",[95,116,117,122],{},[53,118,119],{},[26,120,121],{},"PermitRootLogin no",[53,123,124,125,128],{},"Use a normal user + ",[26,126,127],{},"sudo"," instead",[79,130,132],{"id":131},"_3-limit-who-can-connect","3. Limit who can connect",[95,134,135,145],{},[53,136,137,140,141,144],{},[26,138,139],{},"AllowUsers youradmin"," (or ",[26,142,143],{},"AllowGroups ssh-users",")",[53,146,147],{},"Keep the list short; update it when staff change",[79,149,151],{"id":150},"_4-tighten-session-behaviour","4. Tighten session behaviour",[14,153,154],{},"Useful starting points (tune to your needs):",[95,156,157,162,167],{},[53,158,159],{},[26,160,161],{},"MaxAuthTries 3",[53,163,164],{},[26,165,166],{},"LoginGraceTime 30",[53,168,169,172,173,176],{},[26,170,171],{},"ClientAliveInterval 300"," and ",[26,174,175],{},"ClientAliveCountMax 2"," for idle disconnects",[79,178,180],{"id":179},"_5-restrict-network-exposure","5. Restrict network exposure",[14,182,183,184,187],{},"Hardening ",[26,185,186],{},"sshd"," is weaker if the whole internet can reach it forever.",[95,189,190,193],{},[53,191,192],{},"Firewall: allow SSH only from trusted IPs or a VPN where practical",[53,194,195,196,199],{},"Changing the port reduces noisy scans; it is ",[41,197,198],{},"not"," a substitute for keys and access limits",[79,201,203],{"id":202},"_6-validate-then-reload","6. Validate, then reload",[205,206,211],"pre",{"className":207,"code":208,"language":209,"meta":210,"style":210},"language-bash shiki shiki-themes github-dark","sudo sshd -t\nsudo sshd -T | grep -E 'passwordauthentication|permitrootlogin|allowusers'\nsudo systemctl reload ssh   # or sshd, depending on distro\n","bash","",[26,212,213,229,252],{"__ignoreMap":210},[214,215,218,221,225],"span",{"class":216,"line":217},"line",1,[214,219,127],{"class":220},"svObZ",[214,222,224],{"class":223},"sU2Wk"," sshd",[214,226,228],{"class":227},"sDLfK"," -t\n",[214,230,232,234,236,239,243,246,249],{"class":216,"line":231},2,[214,233,127],{"class":220},[214,235,224],{"class":223},[214,237,238],{"class":227}," -T",[214,240,242],{"class":241},"snl16"," |",[214,244,245],{"class":220}," grep",[214,247,248],{"class":227}," -E",[214,250,251],{"class":223}," 'passwordauthentication|permitrootlogin|allowusers'\n",[214,253,255,257,260,263,266],{"class":216,"line":254},3,[214,256,127],{"class":220},[214,258,259],{"class":223}," systemctl",[214,261,262],{"class":223}," reload",[214,264,265],{"class":223}," ssh",[214,267,269],{"class":268},"sAwPA","   # or sshd, depending on distro\n",[14,271,272,273,276],{},"Test a ",[41,274,275],{},"new"," login in a second terminal before you close the safety session.",[18,278,280],{"id":279},"what-this-does-not-replace","What this does not replace",[95,282,283,286,289],{},[53,284,285],{},"Patching and unused services still matter",[53,287,288],{},"Docker-published ports can bypass host firewall assumptions — that is a separate problem",[53,290,291],{},"A checklist is not a full server hardening project (accounts, firewall policy, proxy exposure, backups)",[18,293,295],{"id":294},"practical-next-step","Practical next step",[14,297,298,299,304,305,73],{},"If you want the changes applied and verified on one Linux server — with a change record and recovery notes — that is the shape of a Linux server hardening engagement (from £650). Prefer a short conversation first: book a free 15-minute intro call via ",[300,301,303],"a",{"href":302},"\u002Fcontact","contact"," or view the ",[300,306,308],{"href":307},"\u002Fserver-hardening","server hardening service",[14,310,311,312,316,317,172,321,73],{},"Available ",[300,313,315],{"href":314},"\u002Fservice-areas\u002Fderby","in Derby",", ",[300,318,320],{"href":319},"\u002Fservice-areas\u002Fburton-on-trent","Burton-on-Trent",[300,322,324],{"href":323},"\u002Fservice-areas","across the UK",[326,327,328],"style",{},"html pre.shiki code .svObZ, html code.shiki .svObZ{--shiki-default:#B392F0}html pre.shiki code .sU2Wk, html code.shiki .sU2Wk{--shiki-default:#9ECBFF}html pre.shiki code .sDLfK, html code.shiki .sDLfK{--shiki-default:#79B8FF}html pre.shiki code .snl16, html code.shiki .snl16{--shiki-default:#F97583}html pre.shiki code .sAwPA, html code.shiki .sAwPA{--shiki-default:#6A737D}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":210,"searchDepth":231,"depth":231,"links":330},[331,332,333,334,342,343],{"id":20,"depth":231,"text":21},{"id":32,"depth":231,"text":33},{"id":47,"depth":231,"text":48},{"id":76,"depth":231,"text":77,"children":335},[336,337,338,339,340,341],{"id":81,"depth":254,"text":82},{"id":113,"depth":254,"text":114},{"id":131,"depth":254,"text":132},{"id":150,"depth":254,"text":151},{"id":179,"depth":254,"text":180},{"id":202,"depth":254,"text":203},{"id":279,"depth":231,"text":280},{"id":294,"depth":231,"text":295},"2026-09-11","A practical checklist to harden SSH on Linux — keys not passwords, no direct root, verify the new config works — without locking yourself out.",false,"md",true,null,{},"\u002Fguides\u002Flinux-ssh-hardening-checklist","ssh hardening linux",{"title":5,"description":345},"hardening","guides\u002Flinux-ssh-hardening-checklist",[357,358,354],"security","ssh","bzM7CB_XK9bjyOGJ4bPEsJutKVJEqi-Xz4VtpMRceMs","\u003Cspan class=\"line\" line=\"1\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> sshd\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -t\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"2\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> sshd\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -T\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#F97583\"> |\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#B392F0\"> grep\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#79B8FF\"> -E\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> 'passwordauthentication|permitrootlogin|allowusers'\u003C\u002Fspan>\u003C\u002Fspan>\n\u003Cspan class=\"line\" line=\"3\">\u003Cspan style=\"--shiki-default:#B392F0\">sudo\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> systemctl\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> reload\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#9ECBFF\"> ssh\u003C\u002Fspan>\u003Cspan style=\"--shiki-default:#6A737D\">   # or sshd, depending on distro\u003C\u002Fspan>\u003C\u002Fspan>",1792571462481]