SSH 加固与基于密钥的身份验证

SSH is the primary remote-administration channel and a constant target of automated brute-force attacks.

Hardening SSH dramatically reduces the risk of unauthorized access with a handful of configuration changes in /etc/ssh/sshd_config.

Prefer modern Ed25519 keys over older RSA. Generate a pair with a passphrase for defense in depth.

Copy the public key to the server's ~/.ssh/authorized_keys. The helper ssh-copy-id automates this safely.

Once key login works, turn off passwords entirely so brute-force attacks cannot succeed.

In sshd_config:

• PasswordAuthentication no
• ChallengeResponseAuthentication no
• UsePAM yes

Never allow direct root SSH login. Log in as a normal user and escalate with sudo.

Limit who may connect with AllowUsers or AllowGroups. Anyone not listed is rejected outright.

Moving off port 22 will not stop a determined attacker but cuts noisy automated scans considerably.

Remember to update your firewall rules to match.

Tighten the connection handshake to frustrate brute-force tools.

• MaxAuthTries 3
• LoginGraceTime 20
• MaxStartups 10:30:60

fail2ban watches auth logs and temporarily bans IPs after repeated failures, blocking persistent attackers automatically.

Always validate config and keep an existing session open before restarting sshd, so a mistake does not lock you out.

Confirm the effective settings the daemon will use with sshd -T, which prints the resolved configuration.

Test your SSH hardening knowledge.

You have hardened the most exposed Linux service:

• Ed25519 key pairs with passphrases
• PasswordAuthentication no and PermitRootLogin no
• User restrictions and tightened auth limits
• fail2ban for automatic banning
• Always sshd -t and verify before disconnecting

This complements your firewall, VPN, and IDS lessons for layered defense.