The service most attacked on any server.
THE ESSENTIAL CHANGES
Disable password authentication once key access is confirmed working Disable direct root login, using a sudo user instead Consider changing the port from 22, which eliminates most automated scanning noise Limit which users may connect, using an allow list
WHY DISABLE ROOT LOGIN
It removes the single most valuable target. An attacker must then guess both a username and a key, rather than just attacking a known account.
CHANGING THE PORT
Not security by itself, since a determined attacker will find it. But it removes the vast majority of automated attempts, which reduces log noise and load.
If you change it, update your firewall rules first, or you lock yourself out.
ADDITIONAL LAYERS
Install fail2ban or equivalent, which blocks addresses after repeated failures Restrict SSH to specific source addresses in the firewall, if you connect from a fixed location
TESTING EVERY CHANGE
Keep an existing session open while you test a new one. Every SSH configuration change carries a risk of locking yourself out, and an open session is your way back.
