SSH Hardening and Audit Best Practices

The single most impactful SSH hardening step is setting PasswordAuthentication no in /etc/ssh/sshd_config. This forces all users to authenticate with public keys, eliminating the risk from weak or reused passwords and brute force attacks. Ensure at least one authorized key is installed before disabling password authentication to avoid locking yourself out.

The AllowUsers and AllowGroups directives restrict SSH access to named users or group members. For example, AllowGroups sshusers permits only members of the sshusers group. This provides defense in depth: even if an attacker knows a username and obtains credentials, SSH access is denied unless the account is explicitly permitted.

Changing SSH from port 22 to a high-numbered port is a form of obscurity, not security. However, it significantly reduces noise in logs from automated scanners that target port 22. This makes logs easier to analyze for genuine threats. Always maintain firewall rules as the primary access control; port obscurity is a supplementary measure only.

Setting PermitRootLogin no prevents direct root authentication over SSH. Attackers targeting root have a guaranteed valid username and unlimited privileges if they succeed. The recommended setting is PermitRootLogin prohibit-password, which allows root login only with public key authentication, blocking password-based root brute force while preserving emergency access.

MaxAuthTries 3 limits the number of authentication attempts per connection to three. After three failures, the server terminates the connection. This slows brute force attempts. Combined with exponential backoff from fail2ban or SSHGuard, which temporarily ban IPs after repeated failures, brute force attacks become computationally infeasible.

LoginGraceTime specifies how long the server waits for successful authentication before disconnecting. The default is 120 seconds; reducing it to 20 seconds prevents slow brute force attempts and reduces resource holding by unauthenticated connections. ClientAliveInterval and ClientAliveCountMax control connection health checks to disconnect idle or dead sessions.

Modern SSH configurations should restrict algorithms to strong, modern options. In sshd_config, set Ciphers to chacha20-poly1305@openssh.com,aes256-gcm@openssh.com, set MACs to hmac-sha2-256-etm@openssh.com, and set KexAlgorithms to curve25519-sha256. This eliminates legacy algorithms like arcfour, DES, and MD5-based MACs that may be available for backward compatibility.

fail2ban monitors authentication logs and bans IP addresses that exceed a threshold of failed login attempts. After a configurable number of failures within a time window, fail2ban adds an iptables rule to drop further packets from that IP. This automated response makes brute force attacks impractical without requiring manual intervention.

The ssh-audit tool connects to an SSH server and evaluates its configuration: which key exchange algorithms, host key types, ciphers, and MACs it offers, and flags deprecated or weak options. Running ssh-audit against your servers before and after hardening provides objective before-and-after assessment and identifies any configuration gaps.

SSH authentication events are logged via syslog. On Linux, /var/log/auth.log (Debian) or /var/log/secure (RHEL) records every successful and failed login with timestamp, username, source IP, and key fingerprint used. Sending these logs to a centralized SIEM enables detection of unusual access patterns, such as logins from unexpected countries or at unusual hours.

A hardened sshd_config combines: PasswordAuthentication no, PermitRootLogin prohibit-password, MaxAuthTries 3, LoginGraceTime 20, AllowGroups sshusers, restricted Ciphers and MACs, X11Forwarding no, and AllowTcpForwarding no (unless tunneling is required). Each directive removes a specific attack vector, and together they form a defense-in-depth SSH posture.

Which sshd_config setting is the most effective at eliminating brute force password attacks against SSH?

SSH hardening checklist: disable password auth, restrict to AllowGroups/AllowUsers, disable root login or restrict to key-only, set MaxAuthTries 3, reduce LoginGraceTime, restrict algorithms to modern ciphers only, deploy fail2ban or SSHGuard, run ssh-audit for objective assessment, and centralize logs for anomaly detection.