The question: how do you harden SSH on a Linux server in a basic way that you will still keep up in five years, and how do you avoid cutting off your own access on a box you cannot walk up to? I have a routine, but I would like to compare it with yours.
My lean is a short list, not a long one. Key-only login, no root login, and a named list of users who may connect. Everything else I have seen is either a nice extra or a way to make the config harder to read later.
The lockout is the part that bites. My habit is this:
- Put the new settings in a drop-in file, for example
/etc/ssh/sshd_config.d/10-local.conf, so the vendor file stays untouched. Check that your distro's main config actually includes that directory. - Test the syntax before reloading:
sshd -t - Reload, do not restart. Existing sessions stay up.
- Keep that first session open. Open a second one from a new terminal and confirm the key login works before you close the first.
The drop-in looks like this:
...
PasswordAuthentication no
PermitRootLogin no
AllowUsers dwayne backupuser
...
One mistake I see a lot: turning off passwords before confirming the public key is in the right authorized_keys file with the right permissions. A home directory that is too open can make sshd ignore the key. Check the logs for that if the key is refused.
For a box that is truly remote, I also like a second way in that does not depend on SSH, like a console from the host or a provider panel. Think of it as a service door beside the front one.
I have not formed a firm view on changing the port or on tools that ban repeat failures. I know people who swear by them. I am not sure they earn their upkeep once passwords are off.
What is on your minimum list? And what is your safety net when you change SSH on a machine you cannot reach?