SSH Best Practices: Disabling Root Login and Using Keys

SSH Security Keys

The Criticality of SSH Security

The Secure Shell (SSH) protocol is the nervous system of modern server administration. It provides the secure, encrypted channel through which administrators manage Linux infrastructure globally. However, because it grants direct command-line access to the operating system, it is also the primary target for malicious actors.

A server exposed to the public internet will experience hundreds of automated brute-force SSH login attempts every single day. If your server is relying on weak passwords and default configurations, it is only a matter of time before it is compromised. This guide details the essential best practices for securing your SSH daemon (sshd).

Why Passwords are Obsolete

Traditional password authentication is fundamentally flawed for server access. Passwords can be guessed by automated scripts, stolen via phishing, leaked in database breaches, or easily intercepted if a user types them over an insecure connection (though SSH itself is encrypted).

The modern standard is Public Key Cryptography. By utilizing cryptographic key pairs (a public key placed on the server, and a private key kept securely on your laptop), you replace a guessable string of characters with complex mathematics that would take modern supercomputers billions of years to crack.

Step 1: Generating and Deploying SSH Keys

First, you must generate an SSH key pair on your local workstation. The newer ed25519 algorithm is highly recommended over the older rsa due to better performance and security.

# Generate an ED25519 key pair locally
ssh-keygen -t ed25519 -C "[email protected]"

Next, copy the generated public key to your target server using the ssh-copy-id utility.

ssh-copy-id username@server_ip_address

You should now test your connection to ensure you can log in without being prompted for a password.

Step 2: Hardening the SSH Daemon Configuration

Once key-based authentication is verified, you must lock down the SSH daemon by editing its main configuration file: /etc/ssh/sshd_config.

Disable Password Authentication

This is the single most impactful change you can make. By disabling password logins entirely, brute-force attacks instantly become mathematically impossible to execute successfully.

PasswordAuthentication no

Disable Root Login

The root user is the absolute superuser of a Linux system. Because every Linux system has a root user, attackers always know exactly which username to target. Disabling direct root login forces attackers to guess both a username and a password (or compromise a key), significantly increasing the difficulty of an attack.

PermitRootLogin no

Administrators should log in as a standard, unprivileged user and use sudo to execute administrative commands.

Step 3: Advanced SSH Hardening

For high-security environments, consider the following advanced configurations within sshd_config:

  • Change Default Port: While not a defense against targeted attacks, changing Port 22 to Port 2222 eliminates 95% of automated "script kiddie" log spam.
  • Restrict Users: Use AllowUsers admin_user to explicitly deny SSH access to all system accounts except those expressly authorized.
  • Disable X11 Forwarding: If you do not need to run graphical applications over SSH, set X11Forwarding no to reduce the attack surface.

Conclusion

Securing SSH is the foundational step in Linux server administration. By transitioning to ED25519 cryptographic keys, disabling password authentication, and prohibiting direct root access, you effectively neutralize the vast majority of automated network threats. Apply these changes immediately upon provisioning any new server to ensure a secure operational baseline.