-
How to harden SSH: what to turn off and what to keep
Turn off password, root and X11; require a public key. The rest is limits and ciphers. sshd_config line by line.
-
Setting up fail2ban without locking yourself out
Almost everyone who locks themselves out hits one of two mistakes: forgetting their own IP in ignoreip, or setting maxretry too low for a client that opens several connections at once. I measured the real threshold: with maxretry 3 the ban lands on the third failure, and an IP on ignoreip can get it wrong four times and stay out.
-
How to stop typing your key passphrase on every command
ssh-agent keeps the decrypted key in memory while you work and ssh uses it on its own. The script below starts the agent, loads the key with a lifetime, and shows you what to check.
-
Replacing the server password with an SSH key
Turning off PasswordAuthentication removes the path password attacks use, because the client stops getting a password prompt at all. I timed 20 wrong passwords in 4.107 seconds against a test sshd and show the script that installs the key and kills the password without locking you out.
You reached the end. Every post is here.