A
Goal
Harden SSH on a Linux bastion without locking yourself out. This runbook showcases DailyOps ops reading kit: copyable code, interactive checklist, callouts, and tables.
Quick decision matrix
| Situation | Action | Priority |
|---|---|---|
| Internet-facing host | Keys only + fail2ban | P1 |
| Internal bastion | Keys only, MFA jump | P2 |
| Lab / ephemeral | Minimal documented hardening | P3 |
Interactive checklist
Tick items as you go (browser-local state only, nothing is sent to the server):
- Inventory accounts with a shell
- SSH keys deployed for admins
PasswordAuthentication notested on a second session- fail2ban or equivalent enabled
- Break-glass procedure documented
Reference config
bash
# /etc/ssh/sshd_config.d/99-hardening.conf
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers opsadmin jumpuser
After editing:
bash
sshd -t && systemctl reload sshd
Control table
| Control | Where to check | OK when |
|---|---|---|
| Key auth | sshd -T | grep passwordauthentication | no |
| Root login | sshd -T | grep permitrootlogin | no or prohibit-password |
| Banner | /etc/issue.net | Legal notice present |
Common traps
- Disabling passwords before keys are deployed.
- Forgetting service accounts with shells.
- Applying a CIS template with no rollback window.
End of runbook
When the checklist is green, record date, operator, and config hash in the change ticket. The next article connects this kind of content to the rest of the DailyOps knowledge base (links, notes, CTA).