Cyber Security Academy · Lesson

SSH Hardening and Key-Based Auth

Disable password auth, configure key pairs, restrict access with AllowUsers, and use fail2ban.

SSH Hardening and Key-Based Auth is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why SSH Security Matters

SSH is the primary remote administration protocol for Linux servers. A misconfigured SSH server is one of the most common entry points for attackers — exposed to the internet and targeted by constant brute-force bots.

Generating an SSH Key Pair

Key-based auth is stronger than passwords. Generate a key pair:

ssh-keygen -t ed25519 -C "your_email"
# Creates ~/.ssh/id_ed25519 (private) and id_ed25519.pub (public)
# Never share the private key

Installing Public Keys

Copy your public key to the server:

ssh-copy-id user@server
# Or manually:
cat ~/.ssh/id_ed25519.pub >> ~/.ssh/authorized_keys
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys

Disabling Password Authentication

Once key-based auth works, disable password login to eliminate brute-force risk:

# In /etc/ssh/sshd_config:
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
sudo systemctl restart sshd

Changing the Default SSH Port

Moving SSH from port 22 reduces automated scanning noise. It is security through obscurity — not a real defense, but it reduces log spam. Always update firewall rules to match.

# /etc/ssh/sshd_config
Port 2222
# Then update firewall:
ufw allow 2222/tcp
ufw delete allow 22/tcp

Restricting SSH Access by User/IP

Limit which users can SSH and from where:

# /etc/ssh/sshd_config
AllowUsers alice bob
AllowGroups sshusers
# Or restrict by source IP in /etc/hosts.allow:
sshd: 192.168.1.0/24

SSH Timeout and Login Limits

Reduce exposure with session and attempt limits:

# /etc/ssh/sshd_config
ClientAliveInterval 300    # disconnect idle sessions after 5 min
ClientAliveCountMax 2
MaxAuthTries 3             # max password attempts
LoginGraceTime 30          # seconds to authenticate

Using fail2ban

fail2ban monitors log files and bans IPs that show malicious patterns (e.g., too many failed SSH logins). It dynamically updates firewall rules to block attackers.

apt install fail2ban
# /etc/fail2ban/jail.local:
[sshd]
enabled = true
maxretry = 3
bantime = 3600

SSH Agent and Key Forwarding

SSH agent stores your decrypted private key in memory so you don't re-enter the passphrase every login. Agent forwarding (ssh -A) passes your key through hops — use carefully, as a compromised intermediate server could steal your key from the agent socket.

Two-Factor Auth for SSH

Add TOTP to SSH with Google Authenticator PAM module for additional protection even on key-based auth. Requires both the key AND a time-based OTP for login.

Auditing SSH Configuration

Verify your SSH config with:

sshd -T | grep -E "passwordauth|permitroot|pubkeyauth|port"
# Check who is connected:
ss -tnp | grep :22
who

Quick Check: SSH Hardening

Which sshd_config setting should be set to no to eliminate brute-force password attacks against SSH?

Lesson Recap

SSH hardening: use Ed25519 keys, disable password auth, disable root login, change from port 22, restrict AllowUsers, set idle timeouts, install fail2ban. Never share private keys. Audit with sshd -T. Agent forwarding is convenient but risky on untrusted hosts.

Frequently asked questions

Is the “SSH Hardening and Key-Based Auth” lesson free?

Yes — the full text of “SSH Hardening and Key-Based Auth” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “SSH Hardening and Key-Based Auth”?

Disable password auth, configure key pairs, restrict access with AllowUsers, and use fail2ban. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “SSH Hardening and Key-Based Auth” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy