Secure SSH

Disable password login and root login.

The settings go into their own file under /etc/ssh/sshd_config.d/. This survives system updates better than changes to the main configuration.

1. Create the file:

   sudo nano /etc/ssh/sshd_config.d/10-haertung.conf

2. Content:

   PasswordAuthentication no
   KbdInteractiveAuthentication no
   PermitRootLogin prohibit-password

   The line PermitRootLogin prohibit-password allows root to log in with a key only. Password login for root is blocked, key login remains possible. This is useful as an emergency access if the normal user no longer works. With PermitRootLogin no, root would be blocked completely.

   The file 10-haertung.conf deliberately starts with 10. The files in sshd_config.d are read in alphabetical order, and the first value found applies. Many systems place default values in a later file, which this one overrides.

3. Check the configuration and reload the service:

   sudo sshd -t
   sudo systemctl reload ssh

4. Log in from a second terminal before closing the old session.