the ssh baseline that kills the most common internet attack

the attack you're already getting hit with

if you have a box with ssh open to the internet, you are getting brute forced right now. not maybe. right now. bots scan the entire ipv4 range constantly, find port 22 open, and start throwing username and password combos at it. root/root, admin/admin, root/toor, the whole sad list. this isn't a targeted attack on you specifically, it's automated noise that hits everyone, and it's the most common attack pattern on the entire internet because it costs the attacker basically nothing to run.

the good news is this attack only works if you leave the door it's knocking on unlocked. five lines in your sshd config shut the whole thing down. no fancy tooling, no subscription, just config you should have set the day you provisioned the box.

line one: kill password auth entirely

PasswordAuthentication no

this is the big one. brute forcing works by guessing passwords. if password auth is off, there is no password to guess. the only way in is with an ssh key, which is a cryptographic keypair, not a string a bot can iterate through in a wordlist. before you flip this to "no", make sure you've already got key based login working and tested in a second session. don't close your only open session until you've confirmed a new connection works with the key, or you'll lock yourself out of your own box.

generate a key if you don't have one:

ssh-keygen -t ed25519
ssh-copy-id user@yourserver

ed25519 is the modern default, fast and strong. once your key logs you in without a password prompt, you're ready to disable password auth for good.

line two: root doesn't get to log in directly

PermitRootLogin no

root is the account every brute force bot tries first because it's the account with unlimited power on the box. if root can't log in over ssh at all, that entire angle is gone. you still get root access when you need it, you just get there by logging in as a normal user and using sudo. this also means an attacker who somehow gets a normal user's key still has to escalate, they don't just land on root and own the whole machine instantly.

line three: put a guest list on the door

AllowUsers yourusername anotherusername

this line explicitly lists which system accounts are allowed to even attempt an ssh connection. everyone else gets rejected before they get anywhere near an authentication prompt. this matters because servers accumulate accounts over time, service accounts, old accounts from a project that ended, accounts a former contractor used. AllowUsers means even if one of those accounts has a weak or forgotten credential sitting around, it doesn't matter, ssh won't even talk to it. it's a whitelist, and whitelists are almost always stronger than blacklists because you're not trying to guess every bad thing in advance.

putting it together and restarting the service

all of this lives in one file, usually /etc/ssh/sshd_config. edit it with root privileges, make your changes, then check your syntax before you restart anything:

sudo sshd -t

if that command returns nothing, your config is valid. if it throws an error, fix it before restarting, because a broken config plus a restarted ssh daemon means you just locked yourself out. once it checks out clean:

sudo systemctl restart sshd

then, critically, open a brand new terminal and test a fresh connection before you close your existing session. this is the one step people skip and then panic about later. keep your current session alive as a safety net until the new one confirms everything works.

the takeaway

brute force attacks succeed against defaults, not against configured systems. the second you turn off password auth, block root login, and whitelist your users, you've taken away the exact thing those bots are built to exploit. this isn't advanced hardening, it's baseline hygiene that takes five minutes per box. go check every server you run right now, cloud vps, home lab, that raspberry pi you forgot about in the closet, and confirm these five lines are set. do it before you go read about the next fancy attack technique, because none of that matters if the front door is still standing wide open.