SSH security does not begin with port changes; it starts with administrator identity control, undoable key, principle limitation, patch, and recovery path. The main practical risk is that the administrator will close the current input and stay out of the production server before key or firewall testing. Any changes must be tested in the second session and with the emergency console.
Quick answer:Create a separate account manager for each account, install a valid public key, and test login and sudo in the second session. Then limit root login and password authentication as needed, reduce the SSH principle in the firewall or VPN, and set log, alert, rotation, and revoke.
Threat Model of access management
Identify who, from which network and for what they need SSH. Office fixed IP, VPN, bastion and emergency access each have different models. The public server that provides SSH to the entire Internet requires more controls than the host that can only be accessed from the management network.
Before the change: The Path to Salvation
Open the console or rescue mode provider and confirm the credential of the provider account with MFA. Have a backup of the current configuration and rollback mode. The snapshot will not replace the console and independent backup. If the syntax is wrong or the rule closes the access network, the only way back may be out-of-band.
Don't guess the active status.
ss -lntp
systemctl status ssh --no-pager
systemctl status sshd --no-pagerThe unit name varies between distributions; there may be only one of two names. Find the config path and include from the actual service. Enter the active listener, address family, and port. Clear the output containing the IP or internal name before public subscription.
A separate account for each manager.
Using a shared account makes attribution and revoke difficult. Each administrator must have their own user, key, and sudo in proportion to the role. The end of the collaboration should be done by disabling the same account or key, not an emergency replacement of a shared credential for all.
The public key, not the private key transfer.
Only the public key is stored on the server. The private key must remain secure on the device, have a proper password, and never be sent via public email, Git, or ticket. Verify the public key's fingerprint from an independent channel so that the wrong key is not added to the admin account.
Permission of SSH files
Ownership of the home, the folder..sshAnd the authorized keys file must be consistent with the daemon policy.chmod 777It's either insecure or it could break the login. Match the correct value with the active distribution and config documents.
Secure order of password and root restrictions
- Add a separate management account and public key.
- Log in from the second terminal with the same account.
- Test sudo and the necessary operations.
- Check the config with the same syntax-checking tool as the daemon.
- Step by step limit the password/root login.
- Do a controlled reload, not an existing session interruption.
- New successful entry and prohibited entry are really being denied.
Config terms and their behavior depend on the OpenSSH and include order versions. Do not completely replace the old sample file; check the effective config and subsequent overrides.
Effective Syntax Test and Config
OpenSSH is an effective syntax checking and config display tool, but the binary path and the need for connection parameters in versions vary. Use the same active daemon. The success of the syntax only confirms the structure; allow/deny and Match block logic must be tested with the actual login.
What's the value of changing Port?
The default port reduces the volume of the bot and log noise, but the service is still detectable and does not resolve any identity vulnerabilities. Changing the port requires the coordination of the firewall, cloud security group, monitoring and logging.
Firewall, VPN and Allowlist
If the management principles are consistent, network constraints are the most effective controls. For dynamic IP, a VPN or a managed bastion, it can reduce exposure levels. Before applying allowlist, check the alternate route and IPv4/IPv6.Set up the Linux firewallThe anti-lock order covers.
Where's the MFA?
Multi-step acquisition can be in a VPN, bastion, identity-aware proxy, or PAM. Design must include emergency access, recovery code, automation, and service account. Unknown PAM activation on production without session opening and console may disconnect all logins.
SSH agent and forwarding agent.
The agent makes it easy to use the encrypted key, but forwarding it to an untrusted host makes it possible to misuse the agent while connecting. Do not enable public forwarding. For chain access, ProxyJump or bastion with a restricted policy and open logging is usually more manageable.
Service account and automation
The CI/CD key should not have an unlimited shell and sudo. Limit command, path, principle, and file access to deployment requirements. Document rotation and expiration and protect the secret runner from logs.
Algorithm and old version.
Enabling an outdated algorithm just to connect an old client will lower the security level for all users. First design the client to an update or a separate, limited path. The list of supported algorithms is extracted from the actual client/server version; the general template may not be compatible with your build.
Rate Control and Fail2ban
Restricting repetitive effort can reduce brute-force noise, but not key, firewall, and patch. The tool must have the correct log, appropriate backend, and unban path.What is Fail2ban and is it necessary?It explains how to make decisions and test it.
Log and Alert
Successful and unsuccessful logins, keep account/key changes, sudo and config changes. Timestamp and NTP must be correct. alert will sound on any internet scan; risky events such as root logging, logging from a new principle, multiple failures to a valid account, or changing authorized keys are more preferred.
Long and Multiplexing Sessions
A permanent connection can remain after revoking the network or changing roles. Coordinate the idle and lifecycle session policy with the need for operations. A very short timeout also interrupts the administrator in the middle of recovery.
Patch and service level.
The daemon, the encryption library, and the operating system must be patched. Recharge or restart after the update with maintenance window and replacement session. Removing the banner version in appearance does not patch the actual vulnerability.
The final test.
- Access is permitted with the key from the permitted principle.
- sudo just for the part.
- Password/root denial according to policy.
- The violation of the unauthorized principle.
- It needs IPv4 and IPv6 to work.
- Logging and receiving alerts
- Console access and rollback mode
It's not enough to have a successful administrator login; prohibit controls must also be checked from a secure test environment.
Common Mistakes
- Lock the password before the key test.
- Shutting down the firewall without the console.
- Private key sharing between managers
- Giving sudo full to automation
- Depending on port change.
- Enabling the old algorithm for everyone.
- Public forwarding agent
- Edit the config without the syntax test
When do you need special assistance?
If you have multiple managers, CI/CD runners, VPNs or dual networks, an incorrect Match or firewall can disconnect production access.Install and configure the Linux serverIt can implement SSH access with separate accounts, emergency path, logging and rollback.
Common Questions
Should we shut down the root log?
After creating a separate account, key and sudo testing and console validation, direct root access is restricted by the policy.
Is the SSH key secure without a password?
Stealing key files without a password makes it easier to misuse; for automation, secret storage and limited access must replace human protection.
Is Fail2ban enough on its own?
No, it only limits the repetitive effort visible in the log and is not a strong authentication site or firewall.
Is it necessary to change the SSH port?
It's not necessary; it can reduce noise, but it's not the main security control.