Free tools Windows power users keep installed
One-click scans. No signup required.
Harden SSH by first confirming the server’s effective configuration and keeping a separate recovery route, then restricting identities and authentication, testing both allowed and denied connections, and monitoring keys and configuration changes. The exact settings depend on your SSH implementation, version, operating system, and security baseline; a generic configuration pasted onto every server can cause outages or leave controls ineffective.
1. Establish scope and a recovery route
Before changing SSH, identify what is actually running and how it is exposed. Record the server implementation and version, operating system or distribution, configuration files and included fragments, listening interfaces, firewall or cloud access rules, and accounts that need access. Use the system’s official documentation and applicable security baseline to determine valid settings and how the daemon reads them.
As an Amazon Associate I earn from qualifying purchases.
Arrange an administrative recovery path that does not depend on the SSH session you are about to change—for example, an approved console or other out-of-band management route. Keep your existing administrative session open while applying changes. Do not reload or restart the service until you have checked the configuration using the supported procedure for that platform.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 112. Define who and what may connect
Make an access list for human administrators and automated processes. For each principal, specify the destination account, required privileges, approved source locations, and whether it needs forwarding or a restricted command. Grant only the access the task requires; limit privileged accounts and automation keys accordingly.
#1 Best Overall
SSH keys are trust relationships, not anonymous credentials. NIST recommends associating identity keys with individual users. Track each key’s owner, purpose, approving authority, permitted destinations and restrictions, along with a review or rotation plan. Avoid shared private keys, remove authorization when access ends, and consider command restrictions for noninteractive automation when the job supports them. NIST’s IR 7966 guidance on securing SSH covers provisioning, termination, least privilege, monitoring and key management, including the risk that SSH trust can help an attack spread between connected systems.
3. Review server and network controls
Compare the effective server policy with the baseline for your actual system. Review authentication methods, allowed users or groups, root access, authentication-attempt and session limits, forwarding, and network exposure. Defaults are not universal recommendations: the OpenBSD sshd_config manual documents PasswordAuthentication as defaulting to yes and PermitRootLogin as defaulting to prohibit-password. Those are OpenBSD manual values; distributions and effective configurations can differ.
When disabling password authentication
First provision the replacement authentication method and verify it for every account that must retain access. Confirm your independent recovery route, then change the policy using the platform’s supported configuration procedure. Validate the effective configuration, reload or restart as documented, and open a fresh client session to test the new method. Do not rely on an already-authenticated session as proof that a new login will work.
Limit reachability as well as login rights
Where it fits operational needs, restrict SSH at the firewall or cloud access-control layer to approved source addresses and interfaces. A nonstandard port is not a substitute for authentication controls or limiting who may connect.
4. Verify the result with allowed and denied tests
Configuration-file syntax alone does not prove that the intended policy is active. Use the operating system’s official instructions to validate syntax and determine the daemon’s effective configuration. Follow the supported reload or restart process for that system.
- Keep the current session open. Confirm that your out-of-band recovery route remains available.
- Test intended access from a separate client session. Verify each required account and authentication method, including any approved source restrictions.
- Test prohibited access separately. Check that password login, root login, disallowed users, forwarding, or unapproved source locations fail when policy says they should.
- Inspect service and authentication evidence. Review service status and system authentication logs, authorized-key files and their permissions, and any central monitoring. Use platform-specific locations and commands rather than assuming they are the same across systems.
- Record the outcome. Note the host, software version, policy result, date and reviewer, then close the old session only after the new path succeeds.
NIST SP 800-70 Rev. 5 describes configuration checklists as supporting proper-configuration verification and detection of unauthorized changes. NIST also recommends checking SSH configurations and authorized keys after maintenance, and reviewing, documenting and auditing keys and configuration changes. See NIST SP 800-70 Rev. 5 and NIST IR 7966.
Rank #4
5. Choose authentication to fit the environment
Public-key authentication is not the same thing as requiring a hardware security key. A software-held private key may suit some clients and automation; a FIDO2 hardware-backed key is an optional approach that can reduce exposure of an exportable private key, but it adds device compatibility and loss or replacement procedures. Neither approach removes the need to control which accounts and keys are authorized.
For FIDO2 SSH, check the client, operating system and device documentation before adopting it. Yubico documents support and compatibility requirements, including OpenSSH 8.2 or later for FIDO support, 8.4 or later for verify-required, and 8.9 or later for Windows support; the bundled macOS OpenSSH may lack FIDO support. Consult Yubico’s SSH documentation for current compatibility details.
Best Value
- Used Book in Good Condition
6. Maintain keys and configuration
Review authorized keys and trust relationships periodically and after personnel, system or role changes. Revoke credentials when access ends; respond to suspected compromise by revoking affected keys and checking related systems. Monitor authentication activity and changes to SSH configuration, and repeat the verification checks after maintenance or policy changes.
For a fleet, assess SSH key-management tools against discovery coverage, privilege and workflow controls, audit logging, integrations, scale, resilience and deployment fit. NIST IR 7966 discusses enterprise tool-selection considerations but does not endorse a vendor.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitches
