Learn / SSH server settings

SSH server settings

For a server you reach with SSH, such as a small rented VPS. Choose the options and get a ready file for /etc/ssh/sshd_config.d/, plus the order of steps that keeps you from locking yourself out.

PORT

ROOT LOGIN

PASSWORD LOGIN

ATTEMPTS PER CONNECTION

ONLY THESE USERS (OPTIONAL, SEPARATED BY SPACES)

Turn off X11 forwarding (graphical apps over SSH) Turn off tunnels and agent forwarding (leave on only if you use SSH tunnels) Listen on IPv4 only

10-custom.conf

Apply it in this order.

Make sure your key works before turning passwords off: from your PC, ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server, then log in once with the key.
If you change the port, open the new port in the server’s firewall first.
On the server: sudo nano /etc/ssh/sshd_config.d/10-custom.conf, paste, save.
Check it: sudo sshd -t must print nothing. Then sudo systemctl restart ssh.
Keep this session open and log in from a second terminal (ssh -p PORT user@server). Close the first one only when the second works.

Why a separate file. On Debian the main sshd_config reads the files in sshd_config.d/ first, and for most options the first value it reads wins. A name starting with 10- comes before the files that some providers add (often 50-cloud-init.conf), and package updates never overwrite your file. To see the settings really in use: sudo sshd -T.

A different port only reduces noise in the logs; the real protection is keys only, no root and few attempts. A tool such as fail2ban can add temporary bans for addresses that keep failing.

Runs only in your browser: the site’s security policy forbids this page from sending anything over the network.