Day 8: SSH — keys, hardening, drop-in configs
SSH: how you actually reach every server you'll ever manage
SSH (Secure Shell) gives you an encrypted remote shell. Key-based auth is strictly better than passwords: you generate a public/private key pair, put the public key on the server (~/.ssh/authorized_keys), and keep the private key secret on your machine. The server can verify you own the private key without it ever crossing the network.
ssh-keygen -t ed25519 -C "you@example.com"
ssh-copy-id user@server # installs your public key on the server
ssh user@server # now logs in without a passwordHardening sshd
- PasswordAuthentication no — force key-based auth only
- PermitRootLogin no — nobody logs in directly as root
- Change the default port only as weak "security by obscurity" — not a substitute for the above
- AllowUsers / AllowGroups to restrict exactly who can connect
Drop-in configs
Instead of editing /etc/ssh/sshd_config directly, modern OpenSSH reads /etc/ssh/sshd_config.d/*.conf as drop-in overrides. This is the same pattern you'll see everywhere later — systemd drop-ins (Day 10), Kubernetes Kustomize overlays (Phase 12) — small, composable override files instead of editing one giant config in place.
# /etc/ssh/sshd_config.d/10-hardening.conf
PasswordAuthentication no
PermitRootLogin no
AllowUsers deploy
# then: sudo sshd -t && sudo systemctl reload sshdAlways test before reloading
sshd -t validates config syntax before you reload — get it wrong without testing and you can lock yourself out of a remote box with no other access.
Key terms
- Key-based authentication
- Proving identity via a private/public key pair instead of a password.
- sshd_config.d
- A directory of drop-in override files read in addition to the main SSH daemon config.
Why is disabling PasswordAuthentication considered stronger than just picking a long password?
