Lock down incoming SSH connections with server configuration

Link copied

Attach video time

SSH is secure by default, but you can tighten its configuration further by editing /etc/ssh/sshd_config:

sudo nano /etc/ssh/sshd_config

To prevent direct logins as root, set PermitRootLogin to no:

PermitRootLogin no

If you still need to connect as root with an SSH key, set the value to prohibit-password instead:

PermitRootLogin prohibit-password

This blocks password-based root logins while allowing key-based authentication.

You can also disable password authentication for every user on the server. Set PasswordAuthentication to no:

PasswordAuthentication no

With this setting, users must authenticate using another configured method, such as an SSH key.

To restrict SSH access to specific users, search for AllowUsers in the configuration file or add the directive if it doesn’t exist. Its value is a space-delimited list of users:

AllowUsers deploy admin

You can restrict a user to a specific source IP address by appending the address to the username:

AllowUsers [email protected]

You can also allow connections from a specific IP address without limiting them to one username:

AllowUsers *@203.0.113.10

Choose the rule that matches your access requirements. Be careful when restricting users or disabling passwords, and make sure you have another working authentication method before closing your current session.

Restart the SSH service after saving the configuration:

sudo service ssh restart

The new settings take effect after the service restarts.