OpenSSH hardening checklist

Start with access recovery

Keep a working session open and ensure console access before editing remote SSH configuration.

Key settings

PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
KbdInteractiveAuthentication no
AllowUsers adminuser

Check effective configuration

sudo sshd -t
sudo sshd -T -C user=adminuser,host=example,addr=203.0.113.10

Reload carefully

sudo systemctl reload ssh

Important

Ubuntu cloud-init and /etc/ssh/sshd_config.d/*.conf may override expectations; check effective values and Match blocks. If using PAM-based TOTP, KbdInteractiveAuthentication must be enabled and AuthenticationMethods adjusted.