SSH is the single most attacked service on a typical Linux server. If yours is exposed to the internet, something is already trying to brute force it. Most of that attack surface can be removed in about twenty minutes. Here is the order I do it in.
1. Key-based authentication only
The highest-value change. Generate a key, copy it up, then in /etc/ssh/sshd_config:
PasswordAuthentication no
PubkeyAuthentication yes
Test in a second terminal before closing your session. Locking yourself out of a remote server is a bad afternoon.
2. Disable root login
PermitRootLogin no
Log in as a normal user and escalate. This also gives you an audit trail of who did what, which "everyone shares root" does not.
3. Limit who can log in
AllowUsers deploy admin
An explicit allowlist is stronger than trying to enumerate everyone you want to block.
4. Consider a non-standard port
Moving off 22 does not stop a targeted attacker, but it removes most of the automated background noise, which makes your logs readable. Treat it as noise reduction, not security.
5. Disable unused features
X11Forwarding no
AllowAgentForwarding no
PermitEmptyPasswords no
6. Shorten the login grace period
LoginGraceTime 30
MaxAuthTries 3
7. Rate-limit at the firewall
Block IPs that open many connections in a short window before sshd ever sees them.
8. Install fail2ban
Automatic banning for whatever gets past the above. If you are deciding between fail2ban and a shared-intelligence alternative, I compared them in fail2ban vs CrowdSec.
9. Restart and verify
sudo sshd -t && sudo systemctl restart sshd
The -t catches config errors before you apply them.
10. Watch what happens next
Hardening is a point-in-time action. Config drifts, packages update, someone re-enables password auth for a contractor and forgets. Without monitoring, you find out at the worst moment.
Worth checking regularly: has sshd_config changed, are there new authorized_keys entries you did not add - this is exactly what file integrity monitoring is for - and are failed login patterns shifting to a new source.
SecAI audits SSH configuration and monitors your servers continuously and flags exactly these drifts, alongside the file integrity and behavioural monitoring that catches what hardening alone misses.