Lion Cipher Lab
Harden your SSH server
- Cyber / Security Engineer
- Beginner
- ~25 min
- Free · no account required
Why it matters
An SSH server exposed to a network is one of the most probed doors on the internet. Automated bots hammer port 22 around the clock, trying common usernames and passwords, and the account they most want is root. A default OpenSSH install still accepts passwords, which means every one of those guesses is a real chance to get in. Hardening closes that off: turn passwords into a non-option so brute force has nothing to guess, refuse direct root login so an attacker can never target the most powerful account, and narrow who may connect at all. These are a handful of lines in one config file, and…
What you'll learn
- SSH server hardening
- editing sshd_config
- disabling password auth
- disabling root login
- reducing attack surface
- safe service restarts
Steps in this lab
- What you're hardening, and why it's worth it
- Confirm key login works BEFORE you change anything
- Keep a second session open — your safety net
- Back up sshd_config before you edit it
- Disable password authentication
- Disable direct root login
- Optional: limit who and where can connect
- Restart safely, then prove a new login works
- What you changed, and the habit underneath it