OpenSSH Server
Zero-Trust Infrastructure Security

OpenSSH Server (sshd_config) Hardening Configuration Generator

Create production-hardened Linux sshd_config files disabling root login, enforcing public keys, limiting ciphers, and setting idle timeouts.

CVE-2024-6387 RegreSSHion Protection Active
Presets:

Changing to a non-standard port stops 99% of automated port 22 credential bots.

DebianBanner (OS Fingerprinting)
Disabling stops OpenSSH from exposing specific Debian/Ubuntu package versions.
Port: 2222Root: noPassAuth: OFF
quantum-modern
# ==============================================================================
# OpenSSH Server Hardened Configuration (sshd_config)
# Target File: /etc/ssh/sshd_config
# Standards: CIS Linux Benchmark / Mozilla Infosec / NIST SP 800-53
# Generated by ToolsAA: https://toolsaa.com/tools/sshd-config-generator
# ==============================================================================

# ------------------------------------------------------------------------------
# 1. Network & Address Binding
# ------------------------------------------------------------------------------
Port 2222
AddressFamily any
ListenAddress 0.0.0.0
ListenAddress ::

# ------------------------------------------------------------------------------
# 2. Host Key Infrastructure (Ed25519 & RSA)
# ------------------------------------------------------------------------------
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key

# ------------------------------------------------------------------------------
# 3. Logging & Auditing (VERBOSE records key fingerprints for auth tracing)
# ------------------------------------------------------------------------------
LogLevel VERBOSE
SyslogFacility AUTH

# ------------------------------------------------------------------------------
# 4. Authentication & Access Control
# ------------------------------------------------------------------------------
PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
KbdInteractiveAuthentication no
ChallengeResponseAuthentication no
GSSAPIAuthentication no
KerberosAuthentication no
StrictModes yes
MaxAuthTries 3
MaxSessions 3
LoginGraceTime 30
AllowGroups ssh-users wheel

# ------------------------------------------------------------------------------
# 5. Cryptography Hardening (Ciphers, KEX, MACs & HostKeyAlgorithms)
# ------------------------------------------------------------------------------
KexAlgorithms [email protected],curve25519-sha256,[email protected],diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
Ciphers [email protected],[email protected],[email protected]
MACs [email protected],[email protected],[email protected]
HostKeyAlgorithms ssh-ed25519,[email protected],rsa-sha2-512,rsa-sha2-256

# ------------------------------------------------------------------------------
# 6. Session Lifecycle & Security Defenses
# ------------------------------------------------------------------------------
ClientAliveInterval 300
ClientAliveCountMax 2
TCPKeepAlive no
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no
GatewayPorts no
PermitUserEnvironment no
Compression no
MaxStartups 10:30:60
UsePAM yes

# ------------------------------------------------------------------------------
# 7. Banners & Information Disclosure
# ------------------------------------------------------------------------------
PrintMotd no
PrintLastLog yes
Banner none
DebianBanner no

# ------------------------------------------------------------------------------
# 8. SFTP Subsystem
# ------------------------------------------------------------------------------
Subsystem sftp internal-sftp
Lines: 79•Chars: 3250•Bytes: 3250
Verified Clean Syntax
Security Rating
Score: 100/100(A+)
Crypto Policy
Post-Quantum & Curve25519
Vulnerability Shield
CVE-2024-6387 Mitigated

Modern Cryptographic Standards

Restricts OpenSSH to post-quantum and curve25519 key exchange, ChaCha20-Poly1305 and AES-GCM AEAD ciphers, completely eliminating legacy CBC and 3DES vulnerabilities.

Zero-Trust Attack Surface Reduction

Enforces strict public key authentication, completely disables root password logins, prevents RegreSSHion (CVE-2024-6387) timing attacks, and terminates idle sessions.

Modular Drop-In & Zero-Downtime Test

Generates full configs or modern drop-in conf.d files alongside a verified deployment shell script featuring sshd -t syntax verification before daemon reloading.

Technical Reference & Architecture Guide

OpenSSH Server (sshd_config) Hardening Configuration Generator — Reference Guide

Generate production-grade, hardened Linux sshd_config templates enforcing public key authentication, modern AEAD ciphers, strict timeouts, and zero root login.

Key Parameters & Controls

PermitRootLoginenum (no | prohibit-password | yes)

Controls whether the root superuser can log in directly via SSH. Setting this to 'no' forces administrative access through unprivileged accounts with sudo escalation.

Default: no
PasswordAuthenticationboolean (yes | no)

Determines whether password-based authentication is accepted. Setting to 'no' strictly enforces asymmetric cryptographic public key authentication.

Default: no
Ciphersstring list

Specifies allowable symmetric encryption algorithms in order of preference, enforcing AEAD modes (chacha20-poly1305, aes256-gcm) and disabling legacy CBC ciphers.

Default: [email protected],[email protected],[email protected]
KexAlgorithmsstring list

Defines allowable Key Exchange algorithms, prioritizing elliptic curve Diffie-Hellman (Curve25519) and rejecting weak 1024-bit DH groups.

Default: curve25519-sha256,[email protected],diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
ClientAliveIntervalinteger (seconds)

Sets an idle timeout interval in seconds after which the server sends a keepalive probe over the encrypted channel.

Default: 300
ClientAliveCountMaxinteger

Sets the number of client keepalive probes that may go unanswered before the SSH server terminates the disconnected or unresponsive session.

Default: 2

Pro Tips & Best Practices

Execute 'sudo sshd -t'

Execute 'sudo sshd -t' to parse /etc/ssh/sshd_config for syntax errors before restarting the daemon. If the command outputs nothing, the configuration syntax is completely valid.

Never disconnect your current working

Never disconnect your current working terminal when reloading sshd. Open a secondary terminal window and initiate a new test connection ('ssh -i ~/.ssh/id_ed25519 user@host') to confirm access before logging out.

Conditional directives declared

Conditional directives declared in 'Match Group' or 'Match User' apply to all subsequent lines until the next Match block or EOF. Keep all global security directives above your first Match statement.

On newer Debian/Ubuntu releases

On newer Debian/Ubuntu releases utilizing systemd socket activation ('ssh.socket'), port and binding changes must be reloaded via 'systemctl restart ssh.socket' or migrated back to ssh.service.

Common Gotchas & Troubleshooting

Permission denied (publickey) after disabling password authentication.

Verify that ~/.ssh has 700 permissions ('chmod 700 ~/.ssh') and authorized_keys has 600 permissions ('chmod 600 ~/.ssh/authorized_keys'). Ensure the user's home directory is not writable by group or other users, as OpenSSH StrictModes strictly enforces this.

sshd fails to start with 'Bad configuration option' or 'Unsupported algorithm'.

Run 'sudo /usr/sbin/sshd -t' to identify deprecated directives or unsupported ciphers. Older OpenSSH releases (prior to 7.6) may not support modern algorithms like curve25519-sha256 or post-quantum hybrid KEX.

Connection refused or timed out after changing the default SSH listening port.

Update firewall rules to permit traffic on the new port ('ufw allow <port>/tcp' or 'nft add rule ...'). If SELinux is enforcing, update the policy via 'semanage port -a -t ssh_port_t -p tcp <port>'.

Frequently Asked Questions

What is the security difference between 'PermitRootLogin no' and 'prohibit-password'?▼

'no' completely blocks root logins across all authentication methods, requiring administrators to log in as a standard user and execute sudo. 'prohibit-password' disables password and keyboard-interactive logins for root but still permits SSH key authentication, which can be useful for automated root backup jobs.

Why are CBC ciphers and MD5/SHA-1 MACs deprecated in hardened SSH configurations?▼

Cipher Block Chaining (CBC) modes are vulnerable to plaintext recovery attacks (such as CVE-2008-5161) via padding oracle exploits. MD5 and SHA-1 hashing algorithms have practical collision vulnerabilities, violating compliance frameworks like PCI-DSS v4.0, NIST SP 800-53, and SOC 2.

How do I test my active OpenSSH server effective runtime parameters?▼

Run 'sshd -T' on the server. Unlike reading the static configuration file, 'sshd -T' displays the evaluated runtime parameters and all active defaults applied by the running OpenSSH daemon in connection context.

How does MaxAuthTries help protect against automated brute-force attacks?▼

Setting 'MaxAuthTries' to a low value (such as 3) limits the number of authentication failures allowed per connection attempt. Combined with network rate limiting tools like fail2ban or nftables, this halts automated credential stuffing and key-guessing attacks after initial retries.

Related Tools & Utilities

All Tools →
Ubuntu UFW (Uncomplicated Firewall) Rules & Script GeneratorSecurity

Generate Ubuntu UFW firewall rules, default drop policies, rate limiting, and port forwarding commands with an executable bash script.

Open tool→
Linux iptables Firewall Rule Builder & Shell Script GeneratorSecurity

Construct iptables rules for INPUT/FORWARD/OUTPUT chains, stateful inspection, SYN flood protection, NAT port forwarding, and script export.

Open tool→
DNS SPF (Sender Policy Framework) Record Builder & ExplainerSecurity

Build and validate RFC 7208 compliant SPF TXT records with IPv4/IPv6 CIDR ranges, MX, A, include mechanisms, and soft/hard fail policies.

Open tool→
DNS DMARC Policy Record Builder & Syntax ValidatorSecurity

Generate RFC 7489 compliant DMARC DNS TXT records with policy enforcement (none/quarantine/reject), rua/ruf aggregate reports, and alignment tags.

Open tool→
DNS CAA (Certification Authority Authorization) Record GeneratorSecurity

Construct RFC 8659 compliant DNS CAA records to restrict SSL/TLS certificate issuance to trusted authorities (Let's Encrypt, DigiCert, Sectigo).

Open tool→
DNS DKIM TXT Record Builder & Selector HelperSecurity

Generate RFC 6376 compliant DNS DKIM TXT records with selector, public key formatting (v=DKIM1; k=rsa; p=...), and verification guidance.

Open tool→