SSH Hardening
Review and tighten SSH access on an Ubuntu server.
Before you run
Keep your current session and independent console access. Confirm another administrator can log in before disabling root access. Include order and Match blocks can change effective settings; use sshd -T -C for the relevant connection. Do not disable password or keyboard-interactive authentication until all accounts, automation and recovery methods are tested.
Server-side steps use Ubuntu as an example. Commands, configuration paths and service names may differ on other systems. Run client-side steps on the client as indicated.
After applying changes, verify that you can sign in and that the intended behavior works in a new SSH session. Keep the current session open until verification succeeds, so you can restore the configuration if necessary.
Examples
Check syntax and effective settings; use sshd -T -C when Match rules apply.
sudo sshd -t
sudo sshd -T | grep -Ei "permitrootlogin|pubkeyauthentication|passwordauthentication|kbdinteractiveauthentication|allowusers"Merge these example settings into the appropriate configuration file; do not replace the whole file. Check Include order and existing overrides.
PermitRootLogin no
PubkeyAuthentication yesOn Ubuntu with the ssh service, validate and reload. Test a new connection before closing the original session.
sudo sshd -t && sudo systemctl reload sshAuthoritative references
Reviewed October 27, 2026