Security Hardening - Part 2: SSH Configuration

Why Harden SSH?

SSH is the main entry point to your server. We’ll make it more secure by:

• Disabling root password login (key-only authentication)
• Disabling password authentication entirely
• Optional: Change SSH port (security through obscurity)

Step 1: Backup Original SSH Config

Always backup before editing:

cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

Step 2: Edit SSH Configuration

nano /etc/ssh/sshd_config

Step 3: Find and Modify These Settings

Use Ctrl+W in nano to search for each setting:

Disable Root Password Login

Find:

#PermitRootLogin yes

Change to:

PermitRootLogin prohibit-password

This allows root login but ONLY with SSH keys (no passwords).

Disable Password Authentication

Find:

#PasswordAuthentication yes

Change to:

PasswordAuthentication no

Disable Empty Passwords

Find:

#PermitEmptyPasswords no

Change to:

PermitEmptyPasswords no

Enable Public Key Authentication (should already be enabled)

Find:

#PubkeyAuthentication yes

Make sure it says:

PubkeyAuthentication yes

Step 4: Optional - Change SSH Port

Note: Only do this if you want extra obscurity. It reduces automated attacks but adds complexity.

Find:

#Port 22

Change to a high port number (example):

Port 2222

If you change the port, update your firewall:

ufw allow 2222/tcp comment 'SSH'
ufw delete allow 22/tcp

Step 5: Save and Exit

In nano:

• Press Ctrl+X
• Press Y to confirm
• Press Enter to save

Step 6: Test SSH Configuration

Before restarting SSH, test the config for errors:

sshd -t

If no output, the config is valid!

If there are errors, it will show them. Fix before continuing.

Step 7: Restart SSH Service

systemctl restart ssh

Check SSH Service Status

systemctl status ssh

You should see:

● ssh.service - OpenBSD Secure Shell server
     Loaded: loaded (/lib/systemd/system/ssh.service; enabled)
     Active: active (running)

If Service Failed to Start

Check for configuration errors:

journalctl -u ssh -n 50

This shows the last 50 log entries for SSH service.

Quick Reference: SSH Service Commands on Ubuntu

# Restart SSH
systemctl restart ssh

# Check status
systemctl status ssh

# Stop SSH
systemctl stop ssh

# Start SSH
systemctl start ssh

# Enable on boot (should already be enabled)
systemctl enable ssh

Now test your new SSH connection from a new terminal window before closing your current session!

ssh root@YOUR_SERVER_IP

Step 9: Update Local SSH Config (Optional)

If you changed the port, update your local ~/.ssh/config:

# On your LOCAL machine (not the VPS)
nano ~/.ssh/config

Add or update:

Host homelab-vps
    HostName YOUR_SERVER_IP
    User root
    Port 2222
    IdentityFile ~/.ssh/id_ed25519

Now you can just use:

ssh homelab-vps