Secure your SSH

Introduction

SSH is the standard protocol for remote server management. Public key authentication instead of passwords improves security and defeats brute-force attacks.

Misconfigured SSH servers are the primary target of botnet scans. This guide covers key generation, distribution, sshd hardening, and operational security.

OpenSSH includes both client (ssh) and server (sshd) tools.

Key Generation

ssh-keygen -t ed25519 -C 'user@host' generates modern secure Ed25519 key. For RSA use minimum 4096 bits.

Private key (~/.ssh/id_ed25519) is never shared; permission must be 600. Public key goes on the server.

ssh-keygen -t ed25519 -C 'deploy@prod'
chmod 600 ~/.ssh/id_ed25519
chmod 700 ~/.ssh

Key Distribution

ssh-copy-id user@server adds public key to ~/.ssh/authorized_keys. Manual: cat id_ed25519.pub >> ~/.ssh/authorized_keys.

authorized_keys permission 600, directory 700. Each line is one key; add from=, command= restrictions.

ssh-copy-id -i ~/.ssh/id_ed25519.pub deploy@server.example.com
# authorized_keys kısıtlama
from="10.0.0.0/8",no-port-forwarding ssh-ed25519 AAAA...

sshd_config Hardening

PasswordAuthentication no disables password login. PermitRootLogin no blocks root SSH. PubkeyAuthentication yes enables key login.

AllowUsers or AllowGroups restricts access. MaxAuthTries 3 limits brute-force. Non-22 port provides obscurity (not sufficient alone).

# /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
AllowUsers deploy admin
MaxAuthTries 3
ClientAliveInterval 300

SSH Agent and Forwarding

ssh-agent holds private key in memory; no repeated passphrase. ssh-add adds keys.

Agent forwarding (-A) is a security risk; use only on trusted jump hosts. ProxyJump (-J) is a safer bastion pattern.

ssh -J bastion.example.com deploy@app.internal
# ~/.ssh/config
Host app
  HostName 10.0.0.5
  User deploy
  ProxyJump bastion

Key Rotation and Revocation

Remove line from authorized_keys when employee leaves. Periodic key rotation requires policy.

ssh-keygen -lf authorized_keys lists fingerprints. Revoked keys must be removed immediately.

Parola kimlik doğrulamasını tamamen kapatın; fail2ban ek koruma sağlar ama anahtar zorunluluğu esastır.

Monitoring and Audit

/auth.log or journalctl -u sshd logs failed logins. Alert when failed attempt threshold is exceeded.

Add google-authenticator PAM module for 2FA; recommended in high-security environments.

1. Ed25519 anahtar kullanın
2. Parolayı kapatın
3. Root login engelleyin
4. AllowUsers tanımlayın
5. Düzenli anahtar denetimi

Conclusion

SSH security comes from proper key management and sshd hardening. Disable password login, rotate keys, limit access with AllowUsers.

Centralize internal network access with bastion host and ProxyJump.