Hardening SSH without locking yourself out

First add and test a public key for a sudo-capable user. Keep the existing root session open while validating a second login.

Create a small override such as /etc/ssh/sshd_config.d/90-local.conf:

PubkeyAuthentication yes
PasswordAuthentication no
PermitRootLogin prohibit-password

Validate before reloading:

sshd -t && systemctl reload sshd

Ubuntu may name the service ssh rather than sshd. If changing the port, allow the new port in the firewall and—on SELinux systems—configure the SSH port type before reloading. A non-standard port reduces log noise but is not a substitute for keys and patching.

Knowledge Base

Hardening SSH without locking yourself out

Please rate this article to help us improve our Knowledge Base.