Recommended Free Tools
The safest SSH lockdown is staged: create a named administrator, install and test its public key in a second session, then disable password and direct-root logins, restrict accounts and forwarding, and narrow the network with a firewall. Keep your current session and provider console open until the new policy has been verified. The sequence below is reversible and accounts for the most common ways administrators lock themselves out.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What SSH hardening changes on a VPS
SSH is both an administration interface and a network service exposed to the internet. Hardening does not mean turning on one magic option. It means reducing the number of ways an attacker can reach the daemon, authenticate, move through the host, or use an account after login.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Authentication: prefer possession of a private key over passwords, and add a second factor or second key when the risk justifies it.
- Authorization: allow only the accounts or groups that actually need SSH.
- Privilege: block direct root sessions and use a named account with controlled
sudoaccess. - Session capabilities: disable forwarding and tunneling that the workload does not require.
- Network exposure: permit connections only from administration addresses or networks where possible.
- Operations: keep recovery access, rotate keys, review logs, and validate every configuration change before ending a working session.
OpenSSH defaults and configuration include paths differ between distributions and releases. Record the Linux distribution, package version, listening port, PAM setup, and OpenSSH version before changing anything. Treat the examples in this guide as a baseline to review, not a universal paste-in.
1. Inventory access and prepare a recovery route
Before editing sshd, write down the facts that determine whether you can recover:
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- The current SSH port and the addresses or networks from which administrators connect.
- Every account that currently uses SSH, including automation, monitoring, backup, and deployment accounts.
- The provider’s out-of-band web or serial console, and the exact path for opening it.
- Current firewall rules at both the VPS and provider security-group layers.
- A tested backup or image from which the host can be restored.
- Whether IPv4 and IPv6 are both enabled.
Do not close your only working SSH session. Configuration errors, a missing key, an overly narrow firewall rule, or a forgotten automation account can otherwise turn a small change into a console-only recovery.
If you intend to change the port, do that as a separate, reversible change. A nonstandard port can reduce background noise, but it does not replace key authentication, account restrictions, patching, or a firewall.
2. Create a named administrator and install its key
Create the account with the minimum practical privilege
Use a normal account for routine administration and elevate only when required. On Debian- and Ubuntu-family systems, a typical starting point is:
sudo adduser admin
sudo usermod -aG sudo adminThe group name and privilege mechanism vary by distribution. On systems using a different administrative group, follow that distribution’s documented method. Do not grant broad, passwordless sudo rules simply to make automation convenient; define narrowly scoped commands when a service genuinely needs noninteractive privilege.
Add the public key
From your workstation, copy the public half of the key to the new account, or add it through the provider console. With a conventional OpenSSH client, the workflow is commonly:
ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]If you must create the file manually on the VPS, use the account’s home directory and set ownership and modes before testing:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →install -d -m 700 -o admin -g admin /home/admin/.ssh
install -m 600 -o admin -g admin /dev/null /home/admin/.ssh/authorized_keys
cat /tmp/admin-ed25519.pub >> /home/admin/.ssh/authorized_keysReplace the example path and account names with the values on your host. StrictModes causes sshd to reject keys when the home directory, .ssh directory, or authorized_keys is writable by the wrong user or group. Check the complete path, not just the final file:
namei -l /home/admin/.ssh/authorized_keys
stat -c '%U %G %a %n' /home/admin /home/admin/.ssh /home/admin/.ssh/authorized_keysKeep at least one separate recovery key for the account. Store it securely and document who can use it. A single laptop’s only private key is not a recovery plan.
3. Prove key login before changing authentication
Open a second terminal and make a fresh connection, explicitly selecting the new key:
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
ssh -o IdentitiesOnly=yes -i ~/.ssh/id_ed25519 [email protected]Confirm that the session reaches the intended account, that sudo works as designed, and that you can perform the recovery steps you would need if the next change failed. Test from the network you will normally use; a key that works from an internal jump host does not prove that your home or office path is allowed.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDo not disable passwords until this second login succeeds. Leave the original session untouched while you test. If the key fails, inspect the client with ssh -vv, then check server authentication logs and file ownership before changing policy.
4. Put hardening settings in a reviewable drop-in
Many current Linux packages load files from /etc/ssh/sshd_config.d/ in addition to the main /etc/ssh/sshd_config. A dedicated file such as /etc/ssh/sshd_config.d/10-hardening.conf is easier to review and remove than editing a distribution-managed file. File ordering matters: a later setting can override an earlier one, so inspect all included files for duplicate directives.
Use the editor and ownership conventions appropriate to your distribution. Keep a dated copy of the previous configuration outside the include directory so that a rollback does not accidentally get overridden by another fragment.
5. Disable password and keyboard-interactive authentication only after the key test
A key-only baseline commonly contains:
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication noPasswordAuthentication no removes the ordinary password method. PAM can expose password-equivalent prompts through keyboard-interactive authentication, which is why KbdInteractiveAuthentication no is appropriate when keys are the sole intended method. Do not apply that line blindly if your organization relies on a PAM challenge, one-time code, smart-card workflow, or external identity integration. In those cases, document the required method and test it in a separate session.
Ubuntu’s guidance is direct: if you will always be able to log in with an SSH key, disable password authentication altogether. The operational qualification is important: maintain a working recovery key and provider console before removing the last password path.
6. Block direct root SSH access
Set:
PermitRootLogin noWith this value, root is not allowed to log in through SSH. Administrators connect as the named account and use sudo for privileged operations. This produces clearer audit trails and prevents an exposed root key from becoming an immediate full-privilege session.
The weaker alternative is:
PermitRootLogin prohibit-passwordThat value blocks root passwords and keyboard-interactive authentication but still permits root public-key login. It may be required temporarily by a legacy backup or automation job, but it should be a deliberate exception. If a service must retain root-level automation, consider a dedicated service account, a forced command, a restricted key, and a documented migration plan rather than a general-purpose root key.
7. Restrict which accounts can connect
Use an allow-list, not an assumption
Use either named users or a group:
AllowUsers admin deploy
# or
AllowGroups sshloginIf you use a group, create it and add only intended SSH users:
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
sudo groupadd --system sshlogin
sudo usermod -aG sshlogin adminGroup and command names differ on some distributions. Verify membership in a new login session before enforcing the allow-list. Remember that an allow-list can exclude emergency accounts, deployment users, or a provider’s recovery user if you do not inventory them first.
Separate service access from human access
Do not share one private key among people or jobs. Give each operator and automation role its own key so a departure, laptop loss, or compromised pipeline can be revoked without replacing everyone else’s access. Use forced commands and source-address restrictions on keys that only perform one operation.
8. Remove forwarding and tunneling that the workload does not need
Forwarding can turn an otherwise limited SSH account into a pivot through internal services. For accounts that do not need it, the broad control is:
DisableForwarding yesThis disables X11 forwarding, agent forwarding, TCP forwarding, StreamLocal forwarding, and tunnel devices. If administrators need one capability, leave the broad setting off and configure only the required directives:
AllowTcpForwarding local
AllowAgentForwarding no
X11Forwarding no
PermitTunnel noThe exact choice depends on the workload. Developers may need a local port forward; a bastion account may need forwarding but no shell; a file-transfer account may need neither. Apply restrictions per account or group when different roles share the server. Test legitimate workflows before enforcement because a blanket disablement can break database administration, graphical tools, or deployment pipelines.
9. Reduce network exposure with host and provider firewalls
An SSH daemon can be perfectly configured and still be reachable from every address on the internet. Restrict the listener at the provider security-group layer and, where practical, with the VPS firewall.
Allow only an administration address or subnet
Ubuntu’s ufw syntax for allowing TCP port 22 from one address is:
sudo ufw allow proto tcp from 203.0.113.10 to any port 22For an administration network, use its CIDR instead of a single address:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ufw allow proto tcp from 203.0.113.0/24 to any port 22203.0.113.0/24 is documentation space; replace it with your real, stable source range. If you change the SSH port, use that port in the rule and create the firewall allowance before reloading sshd.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Check IPv4, IPv6, and the provider layer
Review numbered rules and confirm the firewall is active:
sudo ufw status numberedThen inspect the provider security group for both address families. An IPv4-only rule does not protect an IPv6 listener. Make sure your administration network actually has the advertised IPv6 path before removing it, and retain provider-console access if an ISP or office address can change.
10. Validate syntax, inspect effective settings, and reload safely
Never discover a syntax error by restarting the only SSH service. On systems that provide the standard OpenSSH tools, run a syntax check first:
sudo sshd -tTo inspect the daemon’s effective values after includes and defaults are applied, many installations support:
sudo sshd -TSome distributions require an explicit configuration path or a different service wrapper. Use the commands supported by the installed package and verify the output for every setting you changed.
Reload rather than abruptly stopping the service, then test another new connection while the old session remains open. Service names commonly differ (ssh versus sshd), so check locally:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo systemctl reload ssh
# or, on systems using the sshd unit:
sudo systemctl reload sshdIf the reload fails, keep the existing session, restore the previous fragment, run the syntax check again, and reload only after it passes. Do not close the old session until the new key, account allow-list, firewall path, and required forwarding behavior all work.
11. Use stronger keys and hardware-backed authentication when appropriate
Choose a modern key type
Ed25519 keys are a practical default for most current OpenSSH clients:
ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519Protect the private key with a strong passphrase and use an agent carefully. Never copy a private key to the VPS; only the public key belongs in authorized_keys.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Consider a FIDO2 security key
OpenSSH supports authenticator-hosted keys through security-key types and the SecurityKeyProvider mechanism. A FIDO2 security key keeps the signing operation in tamper-resistant hardware and requires the physical authenticator, and often a touch or PIN, when connecting. Typical key-generation forms include:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ssh-keygen -t ed25519-sk -f ~/.ssh/id_ed25519_sk
# or, where supported:
ssh-keygen -t ecdsa-sk -f ~/.ssh/id_ecdsa_skSupport depends on the OpenSSH client, operating system libraries, authenticator, and enrollment policy. Check the client’s supported key types before enrollment and test the resulting public key on a noncritical account first. Keep a second enrolled authenticator or a separately protected recovery key; a lost hardware token without a backup can be as disruptive as a lost laptop.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.12. Require multiple authentication methods only when you can operate them
AuthenticationMethods can require a sequence such as:
AuthenticationMethods publickey,passwordThe comma means both methods are required in sequence. If passwords are disabled, that policy cannot succeed. You can also require two distinct public-key authentications where the client and server policy support it, but test enrollment, agent behavior, and recovery carefully. Every method named in the directive must be enabled elsewhere, and a typo or unavailable method can lock out the account. Use a second terminal for every policy change.
13. Keep key files safe and make revocation possible
Rotate and remove individual keys
Give each person, device, and automation role a separate authorized key. When a device is lost or a person leaves, remove only that line from authorized_keys, verify another key still works, and record the change. Replace keys on a schedule appropriate to your risk and immediately after suspected exposure.
Use centralized revocation for larger estates
The RevokedKeys directive can point to a text file of revoked public keys or an OpenSSH key revocation list (KRL). Keep the revocation file readable by the daemon, update it atomically, and test that a revoked key is rejected before relying on it for an incident response procedure.
14. Monitor attempts and maintain the control
Review authentication logs after each policy change and during normal operations. Depending on the distribution, useful commands include:
sudo journalctl -u ssh --since today
sudo journalctl -u sshd --since today
lastLook for successful logins by unexpected accounts, repeated failures against valid usernames, new source addresses, and forwarding or privilege-escalation activity. Keep OpenSSH and the operating system patched. Revisit the allow-list, forwarding rules, firewall ranges, and recovery keys whenever the workload, administrators, or network changes.
Key SSH controls at a glance
| Feature | Security purpose | Operational trade-off |
|---|---|---|
PubkeyAuthentication |
Uses possession of a private key instead of password guessing; can be combined with other methods. | Lost keys require a documented recovery and rotation process. |
AuthenticationMethods |
Requires one or more methods, such as a key plus a password or two distinct keys. | A misconfiguration can lock out users; test every method in a second session. |
PermitRootLogin |
Controls direct root SSH; no blocks it, while prohibit-password still permits root keys. |
Legacy automation may need a service account, forced command, or migration. |
AllowUsers / AllowGroups |
Narrows SSH to named accounts or groups. | Emergency access and group membership must be maintained. |
PasswordAuthentication and KbdInteractiveAuthentication |
Removes password and PAM keyboard-interactive paths when keys are the sole method. | Console, break-glass, or external-identity workflows may require exceptions. |
DisableForwarding and individual forwarding directives |
Reduces pivoting, tunneling, agent abuse, X11 access, and device tunnels. | Developers and operators may depend on legitimate forwarding. |
StrictModes |
Rejects unsafe ownership or permissions on homes and key files. | Incorrect modes can look like an authentication failure. |
RevokedKeys |
Rejects keys listed in a file or OpenSSH KRL. | Revocation files must be readable and replaced atomically. |
SecurityKeyProvider and *-sk keys |
Enables authenticator-hosted, hardware-backed key operations. | Requires compatible clients, authenticators, enrollment, and a backup path. |
| Firewall or provider security group | Restricts which networks can reach the SSH listener. | Overly narrow rules cut off legitimate administration; account for IPv6 and console access. |
A reversible baseline configuration
After the named account and key have been tested, a host that needs no forwarding and uses group-based access might review this fragment:
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AllowGroups sshlogin
DisableForwarding yes
StrictModes yesValidate each line against the installed OpenSSH version, PAM configuration, automation, and provider network. If an account needs forwarding, remove the broad disablement and specify only the required capability. If an identity provider requires keyboard-interactive authentication, do not disable that method merely because it is common in a key-only example.
Lockout prevention and recovery checklist
- Keep the original SSH session open during every change.
- Have the provider console or serial recovery path open in another browser tab.
- Test a named account with its key from a second terminal.
- Run the daemon’s syntax check before reloading.
- Inspect effective configuration, including drop-in files and later overrides.
- Confirm firewall rules for the real administration addresses and for IPv6.
- Reload, do not stop, the service; then make a fresh login.
- Verify required
sudo, deployment, backup, and forwarding workflows. - If locked out, use the provider console to restore the previous drop-in, correct ownership or permissions, and reload; keep a copy of the failing configuration for diagnosis.
What a complete hardening operation looks like
A hardened VPS is not defined by a single setting or by moving SSH to an obscure port. It has a tested key-based entry path, no unnecessary direct-root or password access, an explicit account allow-list, only the forwarding capabilities each role needs, and network rules that expose SSH to the smallest practical set of addresses. Keys are unique, recoverable, and revocable; logs are reviewed; and every change is validated in a second session before the original access is closed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
