Overview

SSH is the main door into your Pod, and internet-facing SSH servers are constantly probed for weak passwords. This article shows how to lock SSH down to key-based authentication and reduce the risk of unauthorised access.

Before you begin

• Root or sudo access.
• Keep an existing SSH session open while you make changes, and open a second session to test before you disconnect.
• Generate a key pair on your local machine if you do not have one:

bash ssh-keygen -t ed25519 -C "[email protected]" ssh-copy-id alypod@<pod-ip>

Steps

1. Create a non-root admin user (if you have not already) and confirm you can log in and run sudo.
2. Edit the SSH daemon configuration:

bash sudo nano /etc/ssh/sshd_config

1. Apply these settings:

PermitRootLogin no PasswordAuthentication no PubkeyAuthentication yes PermitEmptyPasswords no X11Forwarding no MaxAuthTries 4

1. Validate the configuration before restarting, so a typo does not lock you out:

bash sudo sshd -t sudo systemctl restart ssh

1. Confirm you can still log in with your key in a new terminal window, then close the old one.
2. Optionally change the listening port to reduce automated noise. Update your firewall first:

```bash sudo ufw allow 2222/tcp

then set: Port 2222

```

1. Optionally restrict access by source IP in /etc/hosts.allow or via your firewall.

Troubleshooting

• Problem: Permission denied (publickey). Solution: Check ~/.ssh/authorized_keys permissions are 600 and the .ssh directory is 700, and verify the correct key is offered with ssh -v.
• Problem: Locked out after disabling root login. Solution: Use the VNC console in the ALYPOD Console to re-enable a working login path.

Related articles

• [Security best practices for your Pod]
• [Installing and configuring Fail2ban]
• [Auditing logins and access]