SSH is the front door to every box on the fleet. Hardening it removes the easiest paths an attacker uses — password guessing and root login. This defends directly against Password Cracking and brute-force bots.
Keys, not passwords
ssh-keygen -t ed25519 -C "you@host" # on your workstation
ssh-copy-id user@server # install your public keyThen disable password auth in /etc/ssh/sshd_config:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
KbdInteractiveAuthentication no
AllowUsers youruser # allowlist who may log insudo sshd -t && sudo systemctl reload ssh # test config THEN reload⚠️ Keep a session open while you reload, and confirm key login from a second terminal before closing it — a typo in
sshd_configcan lock you out.
Defense in depth
| Control | Why |
|---|---|
| Keys only | Kills password brute force |
AllowUsers allowlist |
Shrinks attack surface |
| fail2ban | Bans repeat offenders |
| Tailscale-only access | Don't expose 22 to the internet at all |
| Non-default port (optional) | Cuts log noise (not real security) |
Best move on this fleet: reach SSH over the Tailscale tailnet and never port-forward 22 publicly. See Tailscale Serve on 443 While Apache Stays on 80.