1 Create a Dedicated Administrative Account

Avoid using a shared administrator or root account for daily management. Individual accounts make it easier to review access, remove former users, and investigate suspicious activity.

# Create a user
sudo adduser adminuser

# Debian or Ubuntu
sudo usermod -aG sudo adminuser

# Fedora, RHEL, Rocky Linux, or AlmaLinux
sudo usermod -aG wheel adminuser

2 Use Strong SSH Keys

Ed25519 is a strong modern default for SSH authentication. Generate the key on a trusted local computer, not on the remote server.

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519

Set a strong passphrase when prompted. The private key must remain secret and should never be uploaded to the server.

ssh-copy-id -i ~/.ssh/id_ed25519.pub This email address is being protected from spambots. You need JavaScript enabled to view it.

The public key may be installed on the server. The private key should remain only on approved client devices and protected backups.

Set secure file permissions

# On the client
chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_ed25519
chmod 644 ~/.ssh/id_ed25519.pub

# On the server
chmod 700 /home/adminuser/.ssh
chmod 600 /home/adminuser/.ssh/authorized_keys
chown -R adminuser:adminuser /home/adminuser/.ssh

3 Harden the SSH Server Configuration

The SSH daemon configuration is commonly located at /etc/ssh/sshd_config. Create a backup before editing:

sudo cp /etc/ssh/sshd_config \
  /etc/ssh/sshd_config.backup.$(date +%F)

Review or add settings similar to the following:

# Keep the standard port unless your network policy requires another
Port 22

# Disable direct root login
PermitRootLogin no

# Use public-key authentication
PubkeyAuthentication yes

# Disable password-based authentication after key testing
PasswordAuthentication no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no

# Permit only approved users
AllowUsers adminuser

# Disable features that are not required
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
PermitTunnel no

# Limit authentication attempts
MaxAuthTries 3
LoginGraceTime 30

# Close inactive sessions
ClientAliveInterval 300
ClientAliveCountMax 2

# Limit concurrent sessions
MaxSessions 10

Validate the configuration

sudo sshd -t

If the command returns an error, fix the configuration before reloading the service.

# Debian or Ubuntu
sudo systemctl reload ssh

# Fedora or RHEL-based systems
sudo systemctl reload sshd

Test a new connection:

ssh -i ~/.ssh/id_ed25519 This email address is being protected from spambots. You need JavaScript enabled to view it.

4 Restrict Network Access

SSH should be reachable only from networks that need administrative access. A VPN, private network, bastion host, or firewall allowlist can significantly reduce exposure.

Example using UFW:

# Allow SSH only from a trusted network
sudo ufw allow from 203.0.113.0/24 to any port 22 proto tcp

# Enable the firewall
sudo ufw enable

# Review active rules
sudo ufw status verbose

Replace the example network with your actual trusted administrative network. Changing the SSH port may reduce automated scanning noise, but it does not replace strong authentication or firewall rules.

5 Add Multi-Factor Authentication

Sensitive environments should consider adding a second authentication factor to SSH. Options include hardware security keys, one-time passwords, and centralized identity providers.

Before applying MFA broadly, test account enrollment, emergency access, recovery procedures, and offline administration scenarios.

6 Restrict Individual SSH Keys

SSH keys can include restrictions in the server user's ~/.ssh/authorized_keys file:

from="203.0.113.25",no-agent-forwarding,no-port-forwarding,no-X11-forwarding,no-pty ssh-ed25519 AAAA... administrator-key

These options can restrict the source address and disable forwarding or interactive shell access when those features are unnecessary.

7 Monitor SSH Activity

Regular log review can identify password spraying, unexpected administrator logins, unfamiliar source addresses, and disabled accounts being targeted.

# View recent SSH logs on systemd systems
sudo journalctl -u ssh --since "24 hours ago"

# Some distributions use sshd as the service name
sudo journalctl -u sshd --since "24 hours ago"

# Debian and Ubuntu authentication logs
sudo grep -i "ssh" /var/log/auth.log

Send authentication logs to a centralized monitoring platform when possible. Create alerts for repeated failures, new administrator accounts, unexpected successful logins, and activity outside normal maintenance windows.