A Small Checklist for SSH Hardening

SSH hardening should reduce exposure without turning a configuration mistake into a locked server. Make one change at a time and keep an existing session open until a second session succeeds.

Start with keys

Create a modern key locally, install only the public key, and verify it before disabling password authentication.

ssh-keygen -t ed25519
ssh-copy-id user@example.net

Validate before reload

OpenSSH can check its complete configuration without restarting the daemon.

sudo sshd -t
sudo sshd -T | grep -E '^(port|passwordauthentication|permitrootlogin) '

Use a safe sequence

1. Allow the new port in the host and provider firewalls.
2. Add the listener and run sshd -t.
3. Reload SSH and establish a new session on the new port.
4. Only then remove the old listener and firewall rule.