# SSH Server Configuration

**SSH server configuration** is controlled by `sshd_config`. Edit `/etc/ssh/sshd_config`, test syntax, then restart the service.

Key security settings:

```
Port 22                          # SSH port (consider 2222 for less noise)
PermitRootLogin no               # disable root login
PubkeyAuthentication yes         # allow public-key auth
PasswordAuthentication no        # disable password auth (use keys)
ChallengeResponseAuthentication no
X11Forwarding no                 # disable X11 if not needed
AllowAgentForwarding no          # disable agent forwarding if not needed
PermitTTY no                     # disable PTY for non-interactive commands
```

User access control:

```
AllowUsers alice bob alice@192.168.1.0/24
DenyUsers root mal@*
AllowGroups ssh-users
```

Client keepalive and idle timeout:

```
ClientAliveInterval 300          # send keepalive every 300 seconds
ClientAliveCountMax 2            # close if no response after 2 pings
LoginGraceTime 30                # timeout before authentication complete
```

Logging:

```
LogLevel VERBOSE                 # detailed log output
SyslogFacility AUTH              # use AUTH facility for syslog
```

Key-based authentication hardening:

```
AuthorizedKeysFile .ssh/authorized_keys
AuthorizedKeysFile none          # if using only ~/.ssh/authorized_keys
StrictModes yes                  # require secure file permissions
```

Advanced options:

```
MaxAuthTries 3                   # max auth attempts per connection
MaxSessions 10                   # max sessions per authenticated user
UsePAM yes                       # use PAM for authentication
GatewayPorts no                  # restrict remote port forwarding
AllowTcpForwarding no            # disable port forwarding
```

Test configuration:

```bash
$ sudo sshd -t
```

Restart SSH:

```bash
$ sudo systemctl restart ssh
```

or on older systems:

```bash
$ sudo service ssh restart
```

View active configuration:

```bash
$ sudo sshd -T
```

Check logs:

```bash
$ sudo tail -f /var/log/auth.log       # Linux
$ sudo log stream --predicate 'process == "sshd"'  # macOS
```

Never disable authentication entirely. Use keys, not passwords.