OpenSSH Server Setup & Hardening

Install & activate

sudo pacman -S openssh
sudo systemctl enable --now sshd.service
ss -tlnp | grep :22                  # confirm listening

Firewall allowance if ufw active (Firewall Basics (ufw)): sudo ufw limit ssh.

Keys first, passwords never

Client side once:

ssh-keygen -t ed25519 -a 100
ssh-copy-id user@server

Server side then:

# /etc/ssh/sshd_config.d/10-hardening.conf
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin no
PubkeyAuthentication yes
X11Forwarding no
MaxAuthTries 3
LoginGraceTime 20
AllowUsers natalie        # explicit allowlist
ClientAliveInterval 300
ClientAliveCountMax 2
sudo systemctl reload sshd
ssh -o PubkeyAuthentication=no user@host   # must FAIL now = correct

Keep your current session open while testing config changes — escape hatch.

Exposure reduction ladder

  1. LAN-only bind: ListenAddress 192.168.x.x

  2. Non-standard port (noise reduction, NOT security): Port 2222 (+ firewall rule change)

  3. VPN/WireGuard front-door instead of internet-exposed SSH

  4. Certificates/principals when teams grow

Brute-force dampening

ufw limit ssh/tcp handles basic rates. Heavier: crowdsec/fail2ban from repos watching journalctl -u sshd (journald & Log Management).

Client quality-of-life

~/.ssh/config:

Host home
  HostName home.example.org
  User natalie
  Port 22
  ServerAliveInterval 60
Host *.lab
  User root
  IdentityFile ~/.ssh/lab_key

Then just ssh home. Multiplexing (ControlMaster auto) speeds repeated sessions.