SSH security cheatsheet

1 - Change default port

nano /etc/ssh/sshd_config // need uncomment Port22 and put other number, then CTRL+O

iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport XXXXX -j ACCEPT
systemctl restart iptables // add security inbound access rule for new port

sudo systemctl restart ssh.service  // for Debian/Ubuntu
sudo systemctl restart sshd.service // for CentOS

ssh -p XXXXX user@server

2 - Setup Authentification

You should disable PasswordAuthentication and only allow access using PubkeyAuthentication to improve brute-force SSH security.

You should disable UseDNS by editing /etc/ssh/sshd_config and setting:
UseDNS no
Otherwise, lfd will be unable to track SSHD login failures successfully as the log files will not report IP addresses