What Is SSH, and How Do You Harden It?
SSH (Secure Shell) is the standard for encrypted remote access to servers — and because it is a direct door into a system, it is one of the most relentlessly attacked services on the internet. The good news is that hardening SSH is well understood and high-impact: a few configuration changes remove the majority of attacks against it.
How does SSH work?#
SSH establishes an encrypted channel between a client and server, then authenticates the user — by password or, far better, by a cryptographic key pair. Once authenticated, it provides a secure shell, file transfer, and tunneling. Its encryption is what makes remote administration safe over untrusted networks, the same asymmetric-then-symmetric pattern as TLS.
What are the key hardening steps?#
In rough order of impact:
| Step | Why |
|---|---|
| Key-based auth, disable passwords | Ends password brute-forcing outright |
| Disable direct root login | Attackers must guess a user and escalate |
| Keep OpenSSH patched | Closes known vulnerabilities |
| Restrict source IPs / use a bastion | Shrinks who can even reach it |
| Limit allowed users, add MFA | Least privilege, defense in depth |
The single biggest win is key-based authentication with passwords disabled. SSH is brute-forced constantly; remove passwords and that entire flood of attacks simply cannot succeed.
Hardened SSH is a cornerstone of secure remote access. More at the Network Security hub.
Frequently asked questions#
How do you harden SSH?
The highest-impact steps: use key-based authentication and disable password login, disable direct root login, keep SSH patched, and restrict access by source where possible. Additional hardening includes limiting which users may log in, disabling unused features, and using multi-factor authentication. Key-based auth alone eliminates password brute-forcing.
Why is key-based authentication better than passwords for SSH?
Key-based authentication uses a cryptographic key pair instead of a password, so there is no password to guess or brute-force, and the private key never leaves the client. SSH is one of the most brute-forced services on the internet; disabling password login removes that entire attack class in a single step.