0Pricing
Linux Networking & TCP/IP for Developers · Lesson

SSH Hardening and Key-Based Authentication

Lock down the most exposed service on Linux servers: configure SSH for key-only login, disable risky defaults, and reduce the attack surface.

SSH Hardening and Key-Based Authentication is a free Linux Networking & TCP/IP for Developers lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Linux Networking & TCP/IP for Developers learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Harden SSH

SSH is the primary remote-administration channel and a constant target of automated brute-force attacks.

Hardening SSH dramatically reduces the risk of unauthorized access with a handful of configuration changes in /etc/ssh/sshd_config.

Generating a Strong Key Pair

Prefer modern Ed25519 keys over older RSA. Generate a pair with a passphrase for defense in depth.

ssh-keygen -t ed25519 -C 'admin@server'

Installing the Public Key

Copy the public key to the server's ~/.ssh/authorized_keys. The helper ssh-copy-id automates this safely.

ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@server

Disabling Password Authentication

Once key login works, turn off passwords entirely so brute-force attacks cannot succeed.

In sshd_config:

  • PasswordAuthentication no
  • ChallengeResponseAuthentication no
  • UsePAM yes
PasswordAuthentication no

Disabling Root Login

Never allow direct root SSH login. Log in as a normal user and escalate with sudo.

PermitRootLogin no

Restricting Users

Limit who may connect with AllowUsers or AllowGroups. Anyone not listed is rejected outright.

AllowUsers admin deploy

Changing the Default Port

Moving off port 22 will not stop a determined attacker but cuts noisy automated scans considerably.

Remember to update your firewall rules to match.

Port 2222

Limiting Authentication Attempts

Tighten the connection handshake to frustrate brute-force tools.

  • MaxAuthTries 3
  • LoginGraceTime 20
  • MaxStartups 10:30:60
MaxAuthTries 3

Adding Fail2ban

fail2ban watches auth logs and temporarily bans IPs after repeated failures, blocking persistent attackers automatically.

sudo apt install fail2ban
sudo systemctl enable --now fail2ban

Testing Before Disconnecting

Always validate config and keep an existing session open before restarting sshd, so a mistake does not lock you out.

sudo sshd -t && sudo systemctl restart ssh

Verifying the Hardened Config

Confirm the effective settings the daemon will use with sshd -T, which prints the resolved configuration.

sudo sshd -T | grep -E 'permitrootlogin|passwordauthentication'

Quick Check

Test your SSH hardening knowledge.

Recap

You have hardened the most exposed Linux service:

  • Ed25519 key pairs with passphrases
  • PasswordAuthentication no and PermitRootLogin no
  • User restrictions and tightened auth limits
  • fail2ban for automatic banning
  • Always sshd -t and verify before disconnecting

This complements your firewall, VPN, and IDS lessons for layered defense.

Frequently asked questions

Is the “SSH Hardening and Key-Based Authentication” lesson free?

Yes — the full text of “SSH Hardening and Key-Based Authentication” is free to read here on the web, and the Linux Networking & TCP/IP for Developers course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Linux Networking & TCP/IP for Developers course, upgrade to CoddyKit PRO.

What will I learn in “SSH Hardening and Key-Based Authentication”?

Lock down the most exposed service on Linux servers: configure SSH for key-only login, disable risky defaults, and reduce the attack surface. You practise Linux Networking & TCP/IP for Developers with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Linux Networking & TCP/IP for Developers?

No prior experience is required. Linux Networking & TCP/IP for Developers on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “SSH Hardening and Key-Based Authentication” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Linux Networking & TCP/IP for Developers lesson?

Yes. Every Linux Networking & TCP/IP for Developers lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Advanced Firewall Rules (nftables)
  2. VPN Concepts & Configuration
  3. Network Intrusion Detection (IDS)
  4. SSH Hardening and Key-Based Authentication
← Back to Linux Networking & TCP/IP for Developers