A lot of people run SSH with default settings which is a security risk. Here is my hardened sshd_config that disables password auth, uses Ed25519 keys only, and sets up fail2ban.
Also covers port knocking for the extra paranoid.
How to harden your SSH config properly
2 weeks ago
3 Replies
2 weeks ago
Port knocking is great until you lock yourself out at 2am because you forgot the sequence. Ask me how I know. But seriously, good guide. The Ed25519 key section is spot on.
2 weeks ago
I would add setting up SSH certificates instead of keys for larger teams. Way easier to manage than distributing public keys to every server.
1 week ago
Also worth mentioning: use a non-standard port. Yes security through obscurity is not real security but it cuts down on automated SSH brute force attempts by 99%.