I am running the following version of GNU/Linux Debian:

cat /etc/issue


Debian GNU/Linux 9

Using the following kernel:

uname -r



And running the following version of OpenSSH:

apt-cache policy openssh-server | grep Installed


Installed: 1:7.4p1-7

My intention is to harden a little one server's SSH security, since I need to have access from any IP, even from any VPN.

These steps I have done so far:

  1. Disabling direct root access:

    cat /etc/ssh/sshd_config | grep PermitRootLogin

    is set to:

    PermitRootLogin no
  2. Enforcing SSH protocol version 2:

    cat /etc/ssh/sshd_config | grep Protocol

    is set to:

    Protocol 2
  3. Changed port to a random one, which I will not write here, so say 12345:

    cat /etc/ssh/sshd_config | grep Port

    is set to:

    Port 12345
  4. I have punched hole in firewall for it:

    sudo iptables -A INPUT -p tcp -m tcp --dport 12345 -m comment --comment "ssh" -j ACCEPT
  5. I have generated a new key of 8 kilobits length (I am aware of the CPU overhead and other disadvantages of such a large key):

    ssh-keygen -t rsa -b 8192
  6. I have then verified the size matches:

    ll /home/fictional_user/.ssh/id_rsa*

    is as it should be, as well as the access rights:

    -rw------- 1 fictional_user fictional_group 6.3K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa
    -rw-r--r-- 1 fictional_user fictional_group 1.4K Mar 16 11:53 /home/fictional_user/.ssh/id_rsa.pub
  7. I have added this key and verified there is no other:

    eval $(ssh-agent -s)
    ssh-add -l

    results in:

    8192 SHA256:gibberish /home/fictional_user/.ssh/id_rsa (RSA)
    8192 SHA256:gibberish fictional_user@fictional_computer (RSA)
  8. I have imported the key to two machines, which will be maintaining the server:

    ssh-copy-id fictional_user@public_ip -p 12345
  9. Afterwards, I have disabled password authentication completely:

    cat /etc/ssh/sshd_config | grep PasswordAuthentication

    is set to:

    PasswordAuthentication no

Question: Did I forget on anything or this is maximum I can do?


2 Answers 2


There are a number of things you can do:

  • Set up a private key that uses a key-stretching algorithm to protect brute-forcing the passphrase.
  • Configure AllowUsers in sshd so only named accounts can gain access
  • Use fail2ban or fwknop to further prevent outside attacks (remember that CVE-2008-0166 caused Debian users to generate only one of 32,767 possible keys)
  • Actively monitor your machine for attacks

Just a few thoughts:

  • sshd supports tcpwrappers, this adds protection when your firewall is down.
  • does your file system support attributes on those public keys? Rather make them as read-only as possible.
  • consider ssh-keysigning to limit the time keys are usable.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .