Hardening SSH on Debian

Purpose

SSH is usually the first administrative surface exposed on a server. A useful baseline should be explicit, easy to audit, and simple to roll back.

Baseline

• Prefer key-based authentication.
• Disable password login after confirming key access.
• Keep a second session open while changing configuration.
• Validate with sshd -t before restarting the service.

Checks

sudo sshd -t
sudo systemctl reload ssh
sudo systemctl status ssh

Notes

Hardening is a sequence, not a single configuration file. Confirm access, validate syntax, reload, and keep the rollback path visible while the change is still fresh.