SSH keys and SSH server hardening

Step 1: Generate an ed25519 key

In a terminal (PowerShell on Windows) run:

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/<KEY_NAME> -C "<PC_NAME>"

ssh-keygen -t ed25519 -a 100 -f $env:USERPROFILE\.ssh\<KEY_NAME> -C "<PC_NAME>"

Enter a passphrase. It protects the key if the file ends up in the wrong hands; a forgotten passphrase cannot be recovered, you then create a new key.

Step 2: Show the public key

cat ~/.ssh/<KEY_NAME>.pub

Get-Content $env:USERPROFILE\.ssh\<KEY_NAME>.pub

A single line starting with ssh-ed25519 AAAAC… and ending with the key comment. Never share the private key (the file without .pub).

Step 3: Upload the key over a password login

The computer and the server must be in the same network. The command asks for the user's password on the server:

ssh-copy-id -i ~/.ssh/<KEY_NAME>.pub -o IdentitiesOnly=yes -o PreferredAuthentications=password -p 22 <ADMIN_USER>@<SERVER_IP>

Get-Content $env:USERPROFILE\.ssh\<KEY_NAME>.pub | ssh -o IdentitiesOnly=yes -o PreferredAuthentications=password -p 22 <ADMIN_USER>@<SERVER_IP> "umask 077; mkdir -p ~/.ssh; cat >> ~/.ssh/authorized_keys"

-o IdentitiesOnly=yes -o PreferredAuthentications=password forces a password login. Without them SSH first tries every key on your computer and the server may close the connection with Too many authentication failures. Windows has no ssh-copy-id; the PowerShell command does the same.

Step 4: Log in with the key

ssh -i ~/.ssh/<KEY_NAME> -o IdentitiesOnly=yes -p 22 <ADMIN_USER>@<SERVER_IP>

ssh -i $env:USERPROFILE\.ssh\<KEY_NAME> -o IdentitiesOnly=yes -p 22 <ADMIN_USER>@<SERVER_IP>

SSH asks for the key passphrase, the one you entered when creating it. If it asks for the user's password on the server, the key was not accepted, see permissions below.

Step 5: Write the settings into a separate file

Into /etc/ssh/sshd_config.d/; the main /etc/ssh/sshd_config stays untouched:

sudo tee /etc/ssh/sshd_config.d/00-hardening.conf <<'EOF'
# Port <SSH_PORT>    (optional: uncomment and set your own port)
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
AuthenticationMethods publickey
EOF

Step 6: Apply the settings

Syntax check first (on an error nothing restarts), then reload. On Ubuntu 24.04 and newer SSH is started by ssh.socket, which reads the port from the configuration only after daemon-reload:

sudo sshd -t && sudo systemctl daemon-reload && sudo systemctl restart ssh.socket ssh

sudo sshd -t && sudo systemctl restart ssh

Step 1: Enter the port in your details and check it is free

Enter the port in your details above; the commands below use it. First check that it is free:

sudo ss -tulpn | grep ':<SSH_PORT>'    # empty output = the port is free

Step 2: Allow the port in the firewall first

Only if UFW is active. Otherwise you will not get in after the restart:

sudo ufw status                                  # active? then allow the new port first
sudo ufw allow <SSH_PORT>/tcp comment 'SSH'

Step 3: Write the port into 00-hardening.conf

The command removes any old Port line and inserts the new one on the first line. The rest of the file stays unchanged:

sudo sed -i -E '/^#? *Port /d' /etc/ssh/sshd_config.d/00-hardening.conf
sudo sed -i '1i Port <SSH_PORT>' /etc/ssh/sshd_config.d/00-hardening.conf
head -n 1 /etc/ssh/sshd_config.d/00-hardening.conf

Step 4: Apply the settings and log in on the new port

In a new window; keep the old one open. If you use the shortcut, update its Port line.

sudo sshd -t && sudo systemctl daemon-reload && sudo systemctl restart ssh.socket ssh

sudo sshd -t && sudo systemctl restart ssh

ssh -i ~/.ssh/<KEY_NAME> -o IdentitiesOnly=yes -p 22 <ADMIN_USER>@<SERVER_IP>

ssh -i $env:USERPROFILE\.ssh\<KEY_NAME> -o IdentitiesOnly=yes -p 22 <ADMIN_USER>@<SERVER_IP>

Step 5: Remove the old rule for port 22

sudo ufw delete allow 22/tcp

Step 1: Effective server settings

The output should match the second block (the order of lines may differ):

sudo sshd -T | grep -E '^(port|pubkeyauthentication|passwordauthentication|kbdinteractiveauthentication|permitrootlogin|authenticationmethods) '

port 22
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no
permitrootlogin no
authenticationmethods publickey

Step 2: What SSH actually listens on

Only your port:

sudo ss -tlnp | grep -E 'ssh|systemd'
cat /run/systemd/generator/ssh.socket.d/addresses.conf    # Ubuntu 24.04+: port taken from the configuration

Step 3: In a new window: the key gets in, the password does not

The key login works (first command). An attempt to log in with a password must be rejected:

ssh -i ~/.ssh/<KEY_NAME> -o IdentitiesOnly=yes -p 22 <ADMIN_USER>@<SERVER_IP>

ssh -i $env:USERPROFILE\.ssh\<KEY_NAME> -o IdentitiesOnly=yes -p 22 <ADMIN_USER>@<SERVER_IP>

ssh -o PubkeyAuthentication=no -o PreferredAuthentications=password -p 22 <ADMIN_USER>@<SERVER_IP>

<ADMIN_USER>@<SERVER_IP>: Permission denied (publickey).

Step 1: Create the user in the ssh-password group

sudo groupadd -f ssh-password
sudo adduser <USER>
sudo usermod -aG ssh-password <USER>

Step 2: Allow the group to log in without a key

SSH asks group members for no key, only for answers through PAM. Everyone else keeps logging in with a key:

sudo tee /etc/ssh/sshd_config.d/10-ssh-password.conf <<'EOF'
Match Group ssh-password
    AuthenticationMethods keyboard-interactive
EOF
sudo sshd -t && sudo systemctl restart ssh

Step 3: Check that the password alone does not get in

Until you turn on 2FA, interactive login is off and the user cannot log in at all:

sudo sshd -T -C user=<USER>,host=localhost,addr=127.0.0.1 | grep -E '^(kbdinteractiveauthentication|authenticationmethods) '

kbdinteractiveauthentication no
authenticationmethods keyboard-interactive

They can log in only after 2FA is on (the next step), with the password and the code. You create the secret key for their phone there, in the Other users step.