SSH Hardening

SSH is the front door to every box on the fleet. Hardening it removes the easiest paths an attacker uses — password guessing and root login. This defends directly against Password Cracking and brute-force bots.

#Keys, not passwords

ssh-keygen -t ed25519 -C "you@host"          # on your workstation
ssh-copy-id user@server                       # install your public key

Then disable password auth in /etc/ssh/sshd_config:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication no
AllowUsers youruser                # allowlist who may log in

sudo sshd -t && sudo systemctl reload ssh     # test config THEN reload

⚠️ Keep a session open while you reload, and confirm key login from a second terminal before closing it — a typo in sshd_config can lock you out.

#Defense in depth

Best move on this fleet: reach SSH over the Tailscale tailnet and never port-forward 22 publicly. See Tailscale Serve on 443 While Apache Stays on 80.