SSH Hardening, Firewall & Exposure

What is it?

SSH hardening means key-based auth, no root login and sane settings in sshd_config. A firewall (ufw/nftables) limits which ports are reachable; service exposure is which interfaces a service binds to.

Why it matters

SSH and open ports are the internet-facing attack surface. Password SSH open to the world is brute-forced constantly; every unnecessary open port is a needless risk.

Where you see it

`/etc/ssh/sshd_config` (PermitRootLogin no, PasswordAuthentication no), `ufw status`, and `ss -tlnp` to see what is actually exposed.

What normal looks like

Key-only SSH, root login disabled, a default-deny firewall allowing only needed ports, services bound to the narrowest interface.

What suspicious looks like

PasswordAuthentication yes with PermitRootLogin yes, a firewall allowing all, or a database bound to 0.0.0.0 — the classic internet-exposed server.

How analysts investigate

Read sshd_config for the two key settings, list firewall rules, and cross-check ss to confirm nothing is exposed that shouldn't be — the config and the reality must agree.

Common beginner mistakes

Leaving PasswordAuthentication and root login enabled on an internet-facing host.
Trusting the firewall config without checking what actually listens (ss).

Shrink the attack surface

  /etc/ssh/sshd_config
    PermitRootLogin yes           ← RISK: root brute-forceable
    PasswordAuthentication yes    ← RISK: password guessing
  harden → PermitRootLogin no ; PasswordAuthentication no (keys only)
  ufw default deny incoming ; allow 22,443 only ; DB bound to 10.0.0.0/8

Key-only SSH, no root login, default-deny firewall and narrow binds shrink the internet-facing surface.

Quick check

Which two sshd_config changes most harden an internet-facing server?

A quick self-check — it doesn't affect your XP or progress.